Splunk Search

Help with search

amirarsalan
Explorer

Hi everyone!

I have this serach:

index=_internal [set_local_host] source=license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | search pool="Data Hub" | timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 | fields - _timediff | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

My question is how i can remove all under 4 gb in the results. I only want to show result that's is over 4 gb.
Thanks in advance

Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @amirarsalan,

Use this search:

index=_internal [`set_local_host`] source=license_usage.log type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| where (b/(1024*1024*1024)) > 4
| search pool="Data Hub" 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 
| fields - _timediff 
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @amirarsalan,

Use this search:

index=_internal [`set_local_host`] source=license_usage.log type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| where (b/(1024*1024*1024)) > 4
| search pool="Data Hub" 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 
| fields - _timediff 
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

Cheers,
David

amirarsalan
Explorer

Hi @DavidHourani

I tried your search but the results was "No results found"

0 Karma

DavidHourani
Super Champion

you need to include the | where (b/(1024*1024*1024)) > 4 to filter on anything more than 4GB. Try moving it to the last line and replace it with bwith the volume fields that's in Bytes.

amirarsalan
Explorer

Like this? stil the same results

index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
| where (b/(1024*1024*1024)) > 4

0 Karma

DavidHourani
Super Champion

after this
index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
One of your fields will contain the value you need to have over 4GB, give me the field name so I can give you the where clause 😄

0 Karma

amirarsalan
Explorer

Hmm i don't now if i understand right but this is my serach from the first:
index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

I can see my results correct . But i only want too see value over 4 gb. Don't find that field you want or how can i found it?

0 Karma

amirarsalan
Explorer

@DavidHourani do you mean this:

| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma

DavidHourani
Super Champion

@amirarsalan, yeah. Try something replacing that with this :

foreach * [eval <>=if('<>'>(4*1024*1024*1024),round('<>'/1024/1024/1024, 3),"0"]
0 Karma

amirarsalan
Explorer

Stil not working. Error message "Error in "Eval" command: The expression is malformed. Expected"

index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=if('<>'>(4*1024*1024*1024),round('<>'/1024/1024/1024, 3),"0"]

0 Karma

DavidHourani
Super Champion

Sorry bad formatting, try this :

| foreach * [eval <<FIELD>>=if(round('<<FIELD>>'/1024/1024/1024, 3)>4,round('<<FIELD>>'/1024/1024/1024, 3),"0")]
0 Karma

amirarsalan
Explorer

Thanks a lot @DavidHourani now its working 🙂

0 Karma

DavidHourani
Super Champion

awesome ! this took a while 🙂 🙂

0 Karma

koshyk
Super Champion

I assume the 4gb per given _time, pool, s, st, h, idx ?
You could try.. something like

index=_internal source=*license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx
| where (count/(1024*1024*1024)) > 4
| ... continue with rest of your logic..
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...