Getting Data In

Merging Associated Events

paddy3883
Path Finder

I have a script which sends individual events into Splunk, each event is essentially a report on a HTTP Request, either GET or POST. The event contains a number of fields but two key ones are StepName and Timing:

  1. StepName will be a title for the HTTPRequest etc. PostLogin
  2. Timing will be a int value of the milliseconds taken by HttpRequest

I'm writing a report which shows the average time taken for each step over last 15 minutes. However, from an end users point of view, some steps are part of one process e.g.

  1. Step1 - GetLoginPage
  2. Step2 - PostLoginPage
  3. Step3 - ProcessUserDetails
  4. Step4 - GetHomePage

In this case Step2 and Step3 would be one process for an end user, therefore I'd like to be able to report on these as if they were one step so the following:


GetLoginPage 50

PostLoginPage 100

ProcessUserDetails 250

GetHomePage 80


would become


GetLoginPage 50

PostLoginPage 350

GetHomePage 80


I can use a replace on the StepName so I have


GetLoginPage 50

PostLoginPage 100

PostLoginPage 250

GetHomePage 80


How can I then merge these results so it summates the two PostLoginPage steps and then gives me an average over the time period for the three individual steps?

Note each step has a field called TransactionGUID which associates a group of steps for the same execution.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Hello,

your_search | replace "ProcessUserDetails" with "PostLoginPage" in StepName | chart sum(exec_time) over TransactionGUID by StepName | stats avg(GetLoginPage) avg(PostLoginPage) avg(GetHomePage)

is one way to do it. exec_time would be the field where the execution time is stored.

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Hello,

your_search | replace "ProcessUserDetails" with "PostLoginPage" in StepName | chart sum(exec_time) over TransactionGUID by StepName | stats avg(GetLoginPage) avg(PostLoginPage) avg(GetHomePage)

is one way to do it. exec_time would be the field where the execution time is stored.

Hope this helps,

Kristian

paddy3883
Path Finder

Thanks, I have found a way to do it not too disimilar to this so thanks for feedback.

0 Karma

watsm10
Communicator

I would suggest searching the documentation for eval(case). I had a similar issue and this was a suitable workaround. If you need any more help, let me know 🙂

paddy3883
Path Finder

Thanks, I was able to use the eval for this purpose and work into a solution

0 Karma

watsm10
Communicator

so.. eval StepName = case(HTTPRequest="GetLoginPage","GetLoginPage",(HTTPRequest="PostLoginPage" and HTTPRequest="ProcessUserDetails"),"PostLoginPage",HTTPRequest="GetHomePage","GetHomePage")

so it's case(name of fields you wish to rename/combine,"new name",name of fields you wish to rename/combine,"new name".......)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...