All Apps and Add-ons

Meta Woot! app: How does the search in this dashboard work?

test_qweqwe
Builder

I don't understand the part with eval (what we calculate and for what):

| inputlookup meta_woot  where index=* sourcetype=* host=*
| where recentTime<(now()-3600) 
| eval latency= round((recentTime-lastTime)/60,2)
| eval latency_type=if(latency<0,"Logging Ahead","Logging Behind") 
| eval latency=abs(latency)
| eval latency_type=if(latency="0.00","No Latency",latency_type)
| where latency>=0
| convert ctime(recentTime) ctime(firstTime) ctime(lastTime) ctime(lastUpdated) 
| rename latency AS "latency (mins)" 
| table index, sourcetype, host, firstTime, lastTime, recentTime, "latency (mins)",latency_type, lastUpdated 
| sort - "latency (mins)"

— — — — — — — — — — — — — — — — — — — — — — — —

And what mean:

| rest splunk_server=* /services/server/info

From savedsearches.conf

[Generate Meta Woot Server GUID Lookup]
disabled = 1
action.email.useNSSubject = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize.dispatch.earliest_time = -1d@h
cron_schedule = 0 0 * * *
enableSched = 1
search = | rest splunk_server=* /services/server/info  | fields splunk_server, guid\
| outputlookup meta_woot_server_guid

For what we need fields splunk_server, guid?

0 Karma
1 Solution

maciep
Champion

I haven't used the meta woot app, but i'll take a stab at this....

First off, i don't think those two searches are related. The first is using a lookup that I'm guessing is generated by the metadata command. The second is creating a lookup of splunk server names and their guids, which is probably used elsewhere in the app.

In the first search, recentTime represents the last time an event was indexed. The lastTime field represents the latest event timestamp the indexer knows about (as described in the metadata command). So based on those fields, the search is trying to determine if there is some sort of latency and in which direction. If the lastTime is after the recentTime, then there are probably events in the future, so it's logging ahead. if the lastTime is before the recentTime, then it could be behind. And to make it easier to read the latency in the output, it's getting the absolute value (abs), so that it's always positive. And of course, then just tabling/sorting to make it look nice.

The second search creates a lookup called meta_woot_server_guid that contains splunk server names and their guids. It only needs those two columns, so that's why it limits the results using fields. Like i said above, this lookup is probably used elsewhere in the app when converting from an ugly server guid, to a readable server name (or vice versa).

View solution in original post

maciep
Champion

I haven't used the meta woot app, but i'll take a stab at this....

First off, i don't think those two searches are related. The first is using a lookup that I'm guessing is generated by the metadata command. The second is creating a lookup of splunk server names and their guids, which is probably used elsewhere in the app.

In the first search, recentTime represents the last time an event was indexed. The lastTime field represents the latest event timestamp the indexer knows about (as described in the metadata command). So based on those fields, the search is trying to determine if there is some sort of latency and in which direction. If the lastTime is after the recentTime, then there are probably events in the future, so it's logging ahead. if the lastTime is before the recentTime, then it could be behind. And to make it easier to read the latency in the output, it's getting the absolute value (abs), so that it's always positive. And of course, then just tabling/sorting to make it look nice.

The second search creates a lookup called meta_woot_server_guid that contains splunk server names and their guids. It only needs those two columns, so that's why it limits the results using fields. Like i said above, this lookup is probably used elsewhere in the app when converting from an ugly server guid, to a readable server name (or vice versa).

gjanders
SplunkTrust
SplunkTrust

In MetaWoot the "Meta Woot! License Volume Usage" page uses this lookup for the list of indexers.
It also uses this in one of the data models, so it's used elsewhere in the application as per maciep's answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...