Splunk Search

How do I get my searches to run against the logs of each server, not across all servers?

New Member

Hello

We are trying to use the search below to calculate response times. The search is looking for a thread ID in the 'UnitedSend.log" and its matching thread id in the 'UnitedReceive.log'. It then calculates the difference in the two time stamps associated with the thread ids. The application producing this log is running on 3 different servers. The problem, it's possible for the same thread ID to exist on all three servers. We are seeing odd results in the graph. I believe it’s because it's running the calculation against thread ID on different servers. How do I get the searches to run against each server, not across them?

Search Example:

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

Thanks

0 Karma
1 Solution

Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

View solution in original post

0 Karma

Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

View solution in original post

0 Karma

New Member

Thanks for the help.

0 Karma