Reporting

report acceleration

joe06031990
Communicator

Hi,

I have the bellow search:

I am trying to use acceleration reporting however because the eventstats I can't, I have tried to rewrite the search however it does not work, could someone please help me?

 

index=test sourcetype=test
| eval ResponseTime=round(response_time/1000,2)
| eventstats perc99(ResponseTime) as p99Resp
| eventstats perc90(ResponseTime) as p90Resp
|eventstats perc75(ResponseTime) as p75Resp
| eval p99Unit=if(ResponseTime<=p99Resp,0,1)
| eval p00Response=ResponseTime
| eval p98Response=if(ResponseTime<=p99Resp,ResponseTime,null())
| eval p99Response=if(ResponseTime<=p99Resp,null(),ResponseTime)
| eval p90Unit=if(ResponseTime<=p90Resp,0,1)
| eval p90Response=if(ResponseTime<=p90Resp,ResponseTime,null())
| eval p90Response=if(ResponseTime<=p90Resp,null(),ResponseTime)
| eval p75Unit=if(ResponseTime<=p75Resp,0,1)
| eval p75Response=if(ResponseTime<=p75Resp,ResponseTime,null())
| eval p75Response=if(ResponseTime<=p75Resp,null(),ResponseTime)
| stats sum(p99Unit) as P99Count, avg(p99Response) as p99ResponseAvg, min(p99Response) as p99ResponseMin, max(p99Response) as p99ResponseMax sum(p90Unit) as P90Count, avg(p90Response) as p90ResponseAvg, min(p90Response) as p90ResponseMin, max(p90Response) as p90ResponseMax sum(p75Unit) as P75Count, avg(p75Response) as p75ResponseAvg, min(p75Response) as p75ResponseMin, max(p75Response) as p75ResponseMax
| rename P99Count as "99% Total Count"
| rename p99ResponseAvg as "99% AVG"
| rename p99ResponseMin as "99% Min Response Time"
| rename p99ResponseMax as "99% Max Response Time"
| rename P90Count as "90% Total Count"
| rename p90ResponseAvg as "90% AVG"
| rename p90ResponseMin as "90% Min Response Time"
| rename p90ResponseMax as "90% Max Response Time"
| rename P75Count as "75% Total Count"
| rename p75ResponseAvg as "75% AVG"
| rename p75ResponseMin as "75% Min Response Time"
| rename p75ResponseMax as "75% Max Response Time"

 

Thanks

Joe

0 Karma

codebuilder
SplunkTrust
SplunkTrust

With report acceleration you are restricted to a limited number of commands. See this documentation:
https://docs.splunk.com/Documentation/Splunk/8.2.1/Report/Acceleratereports#Search_mode_and_report_a...

You might be better off using an accelerated datamodel which includes only the fields and time range you need.
https://docs.splunk.com/Documentation/Splunk/8.2.2/Knowledge/Acceleratedatamodels

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

joe06031990
Communicator

Hi,

Thanks for your reply,

I thought you couldn't accelerate a data model with an event stats command? 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...