Splunk Dev

Different Ranges queries

TiagoMatos
Path Finder

Hello. I need to calculate statistics like Avg, Count, from the past two weeks period.

What I want to do next is to check if the same measure in the days AFTER those two weeks are above it or not.

I Can't figure out if it is a join, append or something else to write... Here is what I've got:


index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=8/25/2013:00:00:00 latest=-24h date_wday=friday date_hour=15
| eventstats perc25(executiontime) as Q1Tempo, perc75(executiontime) as Q3Tempo
| eval lim1=Q3Tempo+3*(Q3Tempo-Q1Tempo)
| eval lim2=Q3Tempo+6*(Q3Tempo-Q1Tempo)
| eval lim3=Q3Tempo+10*(Q3Tempo-Q1Tempo)
| eval Performance=case(executiontime>lim3,"High_Alert",executiontime>lim2,"Mid_Alert",executiontime>lim1,"Low_Alert",executiontime<lim1,"OK")
| eval Low=if(executiontime>lim1 AND executiontime<lim2,1,0)
| eval Mid=if(executiontime>lim2 AND executiontime<lim3,1,0)
| eval High=if(executiontime>lim3,1,0)
| eval OutQ=if(executiontime>lim1,1,0)
| stats avg(OutQ) as AvgOut,avg(Low) as AvgLow, avg(Mid) as AvgMid,avg(High) as AvgHigh

Now I want to get those Avg and see where executiontime in the period

index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=9/6/2013:00:00:00 latest=now date_wday=friday date_hour=15

is going. Can you help please?

Thank you

Tags (3)
0 Karma

TiagoMatos
Path Finder
index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=8/25/2013:00:00:00 latest=-24h date_wday=friday date_hour=15

| eventstats perc25(executiontime) as Q1Tempo, perc75(executiontime) as Q3Tempo 

| eval lim1=Q3Tempo+3*(Q3Tempo-Q1Tempo) 

| eval lim2=Q3Tempo+6*(Q3Tempo-Q1Tempo)

| eval lim3=Q3Tempo+10*(Q3Tempo-Q1Tempo) 

| eval     
Performance=case(executiontime>lim3,"High_Alert",executiontime>lim2,"Mid_Alert",executiontime>lim1,"Low_Alert",executiontime<lim1,"OK") 

| eval Low=if(executiontime>lim1 AND executiontime<lim2,1,0) 

| eval Mid=if(executiontime>lim2 AND executiontime<lim3,1,0) 

| eval High=if(executiontime>lim3,1,0) 

| eval OutQ=if(executiontime>lim1,1,0) 

| stats avg(OutQ) as AvgOut,avg(Low) as AvgLow, avg(Mid) as AvgMid,avg(High) as AvgHigh
0 Karma

Ayn
Legend

Format code blocks by blank lines before and after + 4 spaces at the start of each line, please.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...