Monitoring Splunk

How to filter out errors that occur at consecutive intervals?

sid_arora
New Member

This query returns the url with errors at 5m span, I just want to filter out those errors that occur at consecutive intervals, like 9:00 and 9:05.

index = index uriPath=url* |bin span=5m _time
I stats count as Volume, count(eval(httpCode<=299)) as "Success" , count (eval (httpCode>399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP> 2 and Volume > 50

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index = index uriPath=url* |bin span=5m _time
I stats count as Volume, count(eval(httpCode<=299)) as "Success" , count (eval (httpCode>399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP> 2 and Volume > 50
| streamstats range(_time) as gap
| where gap > 300
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...