Splunk Search

Count the number of api occurrence in 10 second

JyotiP
Path Finder

I have the following API's, for which I need to count the occurrence of each in every 10 seconds for 1 hour time interval.

/api/login/v1/session
/api/data/v1/graphql
/api/order/v1/orders
/api/order/v1/states
/api/order/orderimporter/v1/importcsv
/api/order/orderimporter/v1/promote
/api/order/orderimporter/v1/stagingOrder
/api/order/v3/graphql
/api/order/desk/v2/quickSend
/api/order/v1/desk/Batch/sync
/api/order/v1/Orders/sync

I tried with

host=*localhost* Path=*** sourcetype=nginx 
| where Path in ("/api/platform/v1/session" OR "/api/coredata/v1/graphql" OR "/api/trading/v1/orders")
| table Path

But getting Error in 'where' command: Typechecking failed. 'OR' only takes boolean arguments

Basically I want the count of all the listed api in every 10 seconds for 1-hour interval.

Tags (2)
0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Here is an example from some different data:

sourcetype=access_combined earliest=-60m
| bin _time span=10s
| timechart count by action

You might consider using Trellis visualization as well, which automatically creates a different line graph for each.
alt text

0 Karma

techiesid
SplunkTrust
SplunkTrust

It should be smething like below,

host=*localhost* Path=*** sourcetype=nginx 
 | search Path IN  ("/api/platform/v1/session" ,"/api/coredata/v1/graphql" , "/api/trading/v1/orders")
 | table Path
| timechart count span=10s

Sid

JyotiP
Path Finder

@techiesid this work fine without timechart count span=10s, when I use this no result is coming

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!