Knowledge Management

Dynamic grouping of results

aalvino
Engager

I am using splunk to ingest haproxy logs. Our HAproxy forwards requests onto a number of different servers for access to various APIs. Currently I have some reports to find the average repsonse times, 95th percentile etc for these different API calls. The current reports do searches on strings for the APIs and to generate the report. The API strings are hard coded in the reports. For example here is the framework of one of the reports:

sourcetype=haproxy:http status=200 ("api1_string?" OR "api2_string?" OR "api3_string?" OR "api4_string?" ) | eval API=case(searchmatch("api1_string?"),"api1",
searchmatch("api2_string?"),"api2",
searchmatch("api3_string?"),"api3",
searchmatch("api4_string?"),"api4",
true(),"unknown")
|stats avg(rtt) as AveragePerRequest, perc95(rtt) as 95thPercentile, count as Count by API | eval AveragePerRequest=round(AveragePerRequest,2)

Ideally I could have the strings for the searchmatches and the original search created dynamically.
The field to be evaluated for the api calls is the http_request field from the haproxy log. A couple of examples of

GET /path1/API?option1=answer2&option2=answer2 HTTP/1.1
POST /path1/path2/path3/path4/API HTTP/1.1

So basically the API will be the last path in the http_request dropping the query parameters that come after the ? if there.

So is it possible to dynamically generate the list of APIs for feeding into the report?

I have reviewed quite a bit of documentation, but I have not found anything that might help with this.

Tags (1)
0 Karma
1 Solution

aalvino
Engager

I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:

sourcetype=haproxy:http status=200|
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |

eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)

View solution in original post

0 Karma

aalvino
Engager

I have been able to get this working as I need. Here is what I did incase anyone else is looking to do something similar:

sourcetype=haproxy:http status=200|
eval temp=mvindex(split(http_request,"/"),-2) |
eval temp2=mvindex(split(temp,"?"),0) |
eval api=mvindex(split(temp2," "),0) | fields rtt api |

eventstats perc95(rtt) as p95Resp by api|
eval p00Unit=1 |
eval p95Response=if(rtt<=p95Resp,rtt,null()) |
stats count(p00Unit) as Count, avg(rtt) as Average avg(p95Response) as 95PercentileAvg perc95(rtt) as 95thPercentile count(p95Unit) as 95thPercentileCount by api
| foreach 95PercentileAvg 95thPercentile Average [eval <>=round('<>',2)] | sort -num(Count)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...