Knowledge Management

Summary Index search problems

twinspop
Influencer

My scheduled search:

[Summary Logins Per Second]
action.summary_index = 1
action.summary_index._name = lgn-stats
cron_schedule = 10 5-17 * * 1-5
dispatch.earliest_time = -15m@m
dispatch.latest_time = -5m@m
displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
search = SYSCODE=LGN-*  | sitop _time
vsid = gc6frvm6

After running through a few cycles this morning, I ran this search:

index=lgn-stats search_name="Summary Logins Per Second" | top _time

Our app is particularly busy at the top of the hour. I'm trying to grab the busiest seconds at the top 10 minutes of every hour (X:55:00 - Y:05:00) for monthly reporting. However, the SI search above is returning total events for the entire 10 minutes as the top entries, followed by the top seconds that I really want. Example:

time count percent
1   8/2/10 5:55:00.000 AM   55770   inf
2   8/2/10 6:55:00.000 AM   34025   inf
3   8/2/10 4:55:00.000 AM   24479   inf
4   8/2/10 5:56:59.000 AM   155 inf
5   8/2/10 6:00:05.000 AM   144 inf
6   8/2/10 5:58:40.000 AM   137 inf
7   8/2/10 5:59:30.000 AM   136 inf
8   8/2/10 5:58:42.000 AM   134 inf
9   8/2/10 6:00:12.000 AM   131 inf
10  8/2/10 5:59:25.000 AM   128 inf

Apparently I've misunderstood something basic about the SI command set. Any tips?

Thanks, Jon

Tags (1)
0 Karma
1 Solution

dskillman
Splunk Employee
Splunk Employee

I think the search you want is:

SYSCODE=LGN-* | timechart count span=1s

This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.

If it works then just tack on the sitimechart and use that recurring search to fill your summary.

SYSCODE=LGN-* | sitimechart count span=1s

View solution in original post

0 Karma

dskillman
Splunk Employee
Splunk Employee

I think the search you want is:

SYSCODE=LGN-* | timechart count span=1s

This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.

If it works then just tack on the sitimechart and use that recurring search to fill your summary.

SYSCODE=LGN-* | sitimechart count span=1s
0 Karma

twinspop
Influencer

Yeah, that's what I've ended up doing. I was trying avoid large result collections, only wanting to keep the top X results each time. (Not exactly what I wanted, but good enough for a check mark.)

Thanks!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...