Splunk Search

Combine two counts where event2 is a subset of event2

elaoumam
Engager

Hi there,

I have these two searchs to count TPS :
First one :

index=tutti sourcetype=toto status!=4  | bucket span=1m _time | stats count by _time | stats sum(count) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

Second one :

index=tutti sourcetype=toto notif=1 AND orig=0 AND status!=9 AND status!=4  | bucket span=1m _time | stats count by _time | stats sum(count) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

I want to combine both counts to sum their counts per minute before deviding by 60 knowing that event2 is a subset of event1 (like counting it twice).

I don't seem to find a way to do that.

Can ayone please help me on this one ?

Best Regards

0 Karma
1 Solution

Sukisen1981
Champion

something like this

index=tutti sourcetype=toto status!=4|eval event=if(notif=1 AND orig=0 AND status!=9 AND status!=4,"event1","event2")|
bucket span=1m _time | stats count(event) by _time

See the output from the above and then you can re-tweak the rest of your code just a bit

View solution in original post

Sukisen1981
Champion

something like this

index=tutti sourcetype=toto status!=4|eval event=if(notif=1 AND orig=0 AND status!=9 AND status!=4,"event1","event2")|
bucket span=1m _time | stats count(event) by _time

See the output from the above and then you can re-tweak the rest of your code just a bit

elaoumam
Engager

Thanks for the answer !
It does work perfectly as expected when tweaking it a bit as follows :
index=tutti sourcetype=toto status!=4 | eval event=if(notif=1 AND orig=0 AND status!=4 AND status!=9,"event2","event1") | bucket span=1m _time | stats count(eval(event="event1")) AS count1, count(eval(event="event2")) AS count2 by _time | eval counts = 2 * count2 + count1 | stats sum(counts) as Rate_per_Minute by _time | eval Rate_per_Second = Rate_per_Minute / 60 | stats max(Rate_per_Second) as Peak_Rate_per_Second by _time | rename _time as Registered_At | fieldformat Registered_At = strftime(Registered_At, "%Y-%m-%d %H:%M:%S") | sort - Peak_Rate_per_Second | head 1

0 Karma

Sukisen1981
Champion

you have done quite a bit of tweaking 🙂 I was not sure about your exact requirements, but knew that what you are looking for is to split the raw events using an if...great that you figured out the rest!

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...