Splunk Search

How come this doesn't work given indexers.csv is a list of Splunk servers with role indexer?

albledsoe
Engager

How come this doesn't work given indexers.csv is a list of Splunk servers with role Indexer?

| inputlookup indexers.csv| rename splunk_server as Indxr| foreach Indxr [search index=_introspection sourcetype=splunk_resource_usage component=IOStats host=Indxr | eval reads_ps = 'data.reads_ps'| eval writes_ps = 'data.writes_ps' | eval writes_ps=avg(write_ps) | eval reads_ps=avg(reads_ps)]

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

That is not what foreach is designed for. It looks like you want to run a search using the value of each splunk_server in your lookup, so use a subsearch like this

index=_introspection sourcetype=splunk_resource_usage component=IOStats [
  | inputlookup indexers.csv 
  | rename splunk_server as host 
]
| eval reads_ps = 'data.reads_ps' 
| eval writes_ps = 'data.writes_ps' 

I have left out the last two avg() statements as that is not how eval works - eval is to perform an action on a single event. If you want to create averages, use some form of stats command, e.g.

| stats avg(write_ps) as writes_ps avg(reads_ps) as reads_ps by host

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

That is not what foreach is designed for. It looks like you want to run a search using the value of each splunk_server in your lookup, so use a subsearch like this

index=_introspection sourcetype=splunk_resource_usage component=IOStats [
  | inputlookup indexers.csv 
  | rename splunk_server as host 
]
| eval reads_ps = 'data.reads_ps' 
| eval writes_ps = 'data.writes_ps' 

I have left out the last two avg() statements as that is not how eval works - eval is to perform an action on a single event. If you want to create averages, use some form of stats command, e.g.

| stats avg(write_ps) as writes_ps avg(reads_ps) as reads_ps by host
0 Karma

albledsoe
Engager

Yep, that's it. It's been sometime since I wrote SPL.  I had been using the REST API in Bash and Javascript. But many don't want to run my scripts. So I am trying to convert to copy/paste SPL. Thanks for the quick tutorial.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...