Splunk Search

Check event count before running stats?

exocore123
Path Finder

I have a query where it runs a certain summary query every 15 minutes in a bucket. However, there are fairly frequent maintenance that happens for our splunk dev team which causes a lot of missing time frames in the query and causes our alerts to misfire.

Currently:

 

index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m  | stats sum(count) as previous by request

 

 

I was wondering if there is something like a way to check if the results from the initial query is more than 3, then run the stats on the data. Otherwise, return nothing.

 

 

index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | where eventcount > 3 | stats sum(count) as previous by request

 

 

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | eventstats count as eventcount | where eventcount > 3 | stats sum(count) as previous by request

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index=summary-ecp-ord-oms source=ecp-ord-owls-transaction-perf-15min earliest=-10080m latest=-10070m | eventstats count as eventcount | where eventcount > 3 | stats sum(count) as previous by request

exocore123
Path Finder

Ooof, I was so close to the answer. Thank you. Didnt realize I was writing eventstat wrong

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...