Reporting

I need to find how many machines in a store have been offline more than 30 days over a 7 month time frame.

swatTC
New Member

There are more than 600+ store each having 50+ machines. The query i used is

storeNo="*" | table machineId,storeId,_time | sort 0 machineId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = tostring(_time - next_seq,"duration") | eval days=if(match(diff,"\+"),replace(diff,"(\d+)(\+.*)","\1"),0) 

It works fine with 1 or 2 stores. However the problem occurs when i run it across all stores. The final result tends to leave out some information/values from the final table. I suspect a memory issue but not sure.

I am a month old to Splunk and learning. Can you help me out here by suggesting any alternative method like iteration/looping or any methods where i can consume less memory.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

storeNo="*" | table machineId,storeId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = abs(_time - next_seq) | eval days=floor(diff/86400) 
0 Karma

swatTC
New Member

The above query is not working. Thank you anyways. My issue is , my posted query works fine with a single store but fails when i run it across all stores.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Whats the logic to identify server is offline or online?

————————————
If this helps, give a like below.
0 Karma

swatTC
New Member

The timestamp between successive logs received for each machine in a store. I need to do a difference between these two time and find if it is greater than say 30 days, indicating the machine has been offline for that period.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...