Reporting

Splunk Host Metrics Report

scout29
Path Finder

I am trying to create a search that will generate a report showing host by event count in the last hour and also the average 7 day hourly event count per host.

So far i have the below search that shows host by event count over the last hour - but i am struggling to get a column added showing the weekly hourly average?

 

| tstats count where index=* by host, index, sourcetype | addtotals | sort -Total | fields - Total | rename count as events_latest_hour

 

Any help on how i get a column added showing the 7 day hourly average for event count ?

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @scout29,

let me understand: you want:

number of events by host in the last hour and the hourly average in the last seven days, is it correct?

please try this:

| tstats count WHERE index=* BY host _time span=1h
| stats 
   avg(count) AS Average
   values(eval(if(_time>=now()-3600,count,0))) AS "Last hour"
   BY host

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @scout29,

let me understand: you want:

number of events by host in the last hour and the hourly average in the last seven days, is it correct?

please try this:

| tstats count WHERE index=* BY host _time span=1h
| stats 
   avg(count) AS Average
   values(eval(if(_time>=now()-3600,count,0))) AS "Last hour"
   BY host

Ciao.

Giuseppe

0 Karma

scout29
Path Finder

@gcusello  - Thanks! How could i modify this to include one more column showing the percent variance between the average count and latest hour count?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @scout29,

use an eval command at the end of the search.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...