Splunk Search

Compare field of each event with Subsearch of past each events

Loves-to-Learn Lots

1. If the same JobName field name is already exists,Trying to get average of column value of JobName's elapsedtime value

2. With the average value,I should compare the today's field name with previous date field name's value.

Eg: JobName: 'script_run'   ElapsedTime: 5 -> Here I need to check whether the 'Script name' field name is already existing( In previous Date) or not. If exists, Compare the elapsedtime '5' with that yesterday or any previous day value of  same 'script_run'. If the today's elapsed value is greater than previous day's value, I need to highlight in report. So iterating the today's each JobName with each jobName of previous day to compare the values of each elapsed time of each JobName is needed here.

JobNames are also different. so no any match case is not required here. Getting the JobNames with field name


index="application_**" host="W4Q**" sourcetype="log"

[search index="application_**" host="W4Q**" sourcetype="log" earliest=-1d@d latest=now

| top JobName,SecondsElapsed | table JobName,SecondsElapsed]

| stats avg(SecondsElapsed) as Duration by JobName,SecondsElapsed

| stats count(eval(if(SecondsElapsed > Duration,true,0))) as LongRun by JobName

 | foreach *

    [eval <<FIELD>>_VAL=if('<<FIELD>>'>Duration,'true',null())]


Any help for this.



Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...