Knowledge Management

Dynamic grouping of results

aalvino
Engager

I am using splunk to ingest haproxy logs. Our HAproxy forwards requests onto a number of different servers for access to various APIs. Currently I have some reports to find the average repsonse times, 95th percentile etc for these different API calls. The current reports do searches on strings for the APIs and to generate the report. The API strings are hard coded in the reports. For example here is the framework of one of the reports:

sourcetype=haproxy:http status=200 ("api1_string?" OR "api2_string?" OR "api3_string?" OR "api4_string?" ) | eval API=case(searchmatch("api1_string?"),"api1",
searchmatch("api2_string?"),"api2",
searchmatch("api3_string?"),"api3",
searchmatch("api4_string?"),"api4",
true(),"unknown")
|stats avg(rtt) as AveragePerRequest, perc95(rtt) as 95thPercentile, count as Count by API | eval AveragePerRequest=round(AveragePerRequest,2)

Ideally I could have the strings for the searchmatches and the original search created dynamically.
The field to be evaluated for the api calls is the http_request field from the haproxy log. A couple of examples of

GET /path1/API?option1=answer2&option2=answer2 HTTP/1.1
POST /path1/path2/path3/path4/API HTTP/1.1

So basically the API will be the last path in the http_request dropping the query parameters that come after the ? if there.

So is it possible to dynamically generate the list of APIs for feeding into the report?

I have reviewed quite a bit of documentation, but I have not found anything that might help with this.

Tags (1)
0 Karma
1 Solution

aalvino
Engager

I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:

sourcetype=haproxy:http status=200|
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |

eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)

View solution in original post

0 Karma

aalvino
Engager

I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:

sourcetype=haproxy:http status=200|
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |

eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...