Splunk Search

Counting number of hits in a range

mehuman
New Member

Hi,
I'm trying to count the number of events where a value is over a certain amount as well as within a number of ranges.

Here is my search:

sourcetype=source | rex field=_raw "Java memory percentage: (?<java_mem_percent>.*), OS memory percentage: (?<os_mem_percent>.*)" | rex field=_raw "images was (?<launch_time>.*)" | stats count(eval(java_mem_percent>"90"))

Here is how the data is formatted:

Java memory percentage: 75, OS memory percentage: 64
Java memory percentage: 82, OS memory percentage: 75
Java memory percentage: 34, OS memory percentage: 32
Java memory percentage: 56, OS memory percentage: 79
Java memory percentage: 95, OS memory percentage: 67

Thanks!

Tags (1)
0 Karma

krugger
Communicator

I would say a where would filter out only the events when the memory percentage is above 90:

sourcetype=source | rex field=_raw "Java memory percentage: (?.*), OS memory percentage: (?.*)" | rex field=_raw "images was (?.*)" | where java_mem_percent > 90 | stats count

However what you might want is actually a rangemap:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

0 Karma

mehuman
New Member

Yes! Rangemap was exactly what I was looking for. Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your stats count(eval(...)) approach is the correct one, where is it failing?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...