Splunk Search

Help with search

amirarsalan
Explorer

Hi everyone!

I have this serach:

index=_internal [set_local_host] source=license_usage.log type="Usage" | eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) | eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) | eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) | bin _time span=1d | stats sum(b) as b by _time, pool, s, st, h, idx | search pool="Data Hub" | timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 | fields - _timediff | foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

My question is how i can remove all under 4 gb in the results. I only want to show result that's is over 4 gb.
Thanks in advance

Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @amirarsalan,

Use this search:

index=_internal [`set_local_host`] source=license_usage.log type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| where (b/(1024*1024*1024)) > 4
| search pool="Data Hub" 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 
| fields - _timediff 
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @amirarsalan,

Use this search:

index=_internal [`set_local_host`] source=license_usage.log type="Usage" 
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx 
| where (b/(1024*1024*1024)) > 4
| search pool="Data Hub" 
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15 
| fields - _timediff 
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

Cheers,
David

amirarsalan
Explorer

Hi @DavidHourani

I tried your search but the results was "No results found"

0 Karma

DavidHourani
Super Champion

you need to include the | where (b/(1024*1024*1024)) > 4 to filter on anything more than 4GB. Try moving it to the last line and replace it with bwith the volume fields that's in Bytes.

amirarsalan
Explorer

Like this? stil the same results

index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
| where (b/(1024*1024*1024)) > 4

0 Karma

DavidHourani
Super Champion

after this
index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]
One of your fields will contain the value you need to have over 4GB, give me the field name so I can give you the where clause 😄

0 Karma

amirarsalan
Explorer

Hmm i don't now if i understand right but this is my serach from the first:
index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

I can see my results correct . But i only want too see value over 4 gb. Don't find that field you want or how can i found it?

0 Karma

amirarsalan
Explorer

@DavidHourani do you mean this:

| foreach * [eval <>=round('<>'/1024/1024/1024, 3)]

0 Karma

DavidHourani
Super Champion

@amirarsalan, yeah. Try something replacing that with this :

foreach * [eval <>=if('<>'>(4*1024*1024*1024),round('<>'/1024/1024/1024, 3),"0"]
0 Karma

amirarsalan
Explorer

Stil not working. Error message "Error in "Eval" command: The expression is malformed. Expected"

index=_internal [set_local_host] source=license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1d
| stats sum(b) as b by _time, pool, s, st, h, idx
| search pool="Data Hub"
| timechart span=1d sum(b) AS volumeB by idx fixedrange=false limit=15
| fields - _timediff
| foreach * [eval <>=if('<>'>(4*1024*1024*1024),round('<>'/1024/1024/1024, 3),"0"]

0 Karma

DavidHourani
Super Champion

Sorry bad formatting, try this :

| foreach * [eval <<FIELD>>=if(round('<<FIELD>>'/1024/1024/1024, 3)>4,round('<<FIELD>>'/1024/1024/1024, 3),"0")]
0 Karma

amirarsalan
Explorer

Thanks a lot @DavidHourani now its working 🙂

0 Karma

DavidHourani
Super Champion

awesome ! this took a while 🙂 🙂

0 Karma

koshyk
Super Champion

I assume the 4gb per given _time, pool, s, st, h, idx ?
You could try.. something like

index=_internal source=*license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h) 
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s) 
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx) 
| bin _time span=1d 
| stats sum(b) as b by _time, pool, s, st, h, idx
| where (count/(1024*1024*1024)) > 4
| ... continue with rest of your logic..
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...