Reporting

report acceleration

joe06031990
Communicator

Hi,

I have the bellow search:

I am trying to use acceleration reporting however because the eventstats I can't, I have tried to rewrite the search however it does not work, could someone please help me?

 

index=test sourcetype=test
| eval ResponseTime=round(response_time/1000,2)
| eventstats perc99(ResponseTime) as p99Resp
| eventstats perc90(ResponseTime) as p90Resp
|eventstats perc75(ResponseTime) as p75Resp
| eval p99Unit=if(ResponseTime<=p99Resp,0,1)
| eval p00Response=ResponseTime
| eval p98Response=if(ResponseTime<=p99Resp,ResponseTime,null())
| eval p99Response=if(ResponseTime<=p99Resp,null(),ResponseTime)
| eval p90Unit=if(ResponseTime<=p90Resp,0,1)
| eval p90Response=if(ResponseTime<=p90Resp,ResponseTime,null())
| eval p90Response=if(ResponseTime<=p90Resp,null(),ResponseTime)
| eval p75Unit=if(ResponseTime<=p75Resp,0,1)
| eval p75Response=if(ResponseTime<=p75Resp,ResponseTime,null())
| eval p75Response=if(ResponseTime<=p75Resp,null(),ResponseTime)
| stats sum(p99Unit) as P99Count, avg(p99Response) as p99ResponseAvg, min(p99Response) as p99ResponseMin, max(p99Response) as p99ResponseMax sum(p90Unit) as P90Count, avg(p90Response) as p90ResponseAvg, min(p90Response) as p90ResponseMin, max(p90Response) as p90ResponseMax sum(p75Unit) as P75Count, avg(p75Response) as p75ResponseAvg, min(p75Response) as p75ResponseMin, max(p75Response) as p75ResponseMax
| rename P99Count as "99% Total Count"
| rename p99ResponseAvg as "99% AVG"
| rename p99ResponseMin as "99% Min Response Time"
| rename p99ResponseMax as "99% Max Response Time"
| rename P90Count as "90% Total Count"
| rename p90ResponseAvg as "90% AVG"
| rename p90ResponseMin as "90% Min Response Time"
| rename p90ResponseMax as "90% Max Response Time"
| rename P75Count as "75% Total Count"
| rename p75ResponseAvg as "75% AVG"
| rename p75ResponseMin as "75% Min Response Time"
| rename p75ResponseMax as "75% Max Response Time"

 

Thanks

Joe

0 Karma

codebuilder
SplunkTrust
SplunkTrust

With report acceleration you are restricted to a limited number of commands. See this documentation:
https://docs.splunk.com/Documentation/Splunk/8.2.1/Report/Acceleratereports#Search_mode_and_report_a...

You might be better off using an accelerated datamodel which includes only the fields and time range you need.
https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Acceleratedatamodels

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

joe06031990
Communicator

Hi,

Thanks for your reply,

I thought you couldn't accelerate a data model with an event stats command? 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...