Splunk Enterprise

table dataset

sarit_s
Communicator

Hello,

The query above calculates some fields for period of time as at the time picker
also, we have an alert which every 6 minutes the values for 2 minuets
i want to save the results of the alert and at the end calculate the results of a whole week

i saw that there is an option to use table dataset

my question is if table dataset is the right option, if yes - how can i do it
if not, what is the best way to achieve my goal 

| stats count as Total_Requests 
    count(eval(Request_Status=500 OR Request_Status=501 OR Request_Status=502 OR Request_Status=503 OR Request_Status=599 OR F5_statusCode=0 OR F5_statusCode="connection limit")) as Requests_Returned_Errors
    count(eval(Request_Status=504 OR F5_serverTime>20000)) as Requests_Returned_Timeouts 
    by API 

| fields API Total_Requests Requests_Returned_Errors Requests_Returned_Timeouts 
| lookup APIs_Owners.csv API OUTPUT Owner 
| eval
    TotalErrors=Requests_Returned_Errors+Requests_Returned_Timeouts,
    SLOTotal=round((Total_Requests-TotalErrors)/Total_Requests*100,2),
    Owner = if(isnotnull(Owner) , Owner ,"null - edit lookup") 
| fields API Total_Requests TotalErrors Requests_Returned_Errors Requests_Returned_Timeouts SLO* Owner

 thanks

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...