Splunk Search

How do I present my search over time?

alexgohberg
Explorer

Hey

I'm trying to present this search over time, but without success. I tried to use buckets and to add by _time, but it doesn't work. Can you pls assist? Thanks.

The search is:

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real 
| iplocation IPAddress 
| search Country=China
| stats count  as TotalLogins
| appendcols [search sourcetype=clientlogs ApplicationIdentifier=AndroidTrader Mode = Real ActionString="#5_Login_User" StatusDetails = "[justified]" 
| iplocation IPAddress 
| search Country=China
| stats count AS JustifiedErrors
| appendcols [search sourcetype=clientlogs ApplicationIdentifier=AndroidTrader Mode = Real ActionString="#5_Login_User"   StatusID=OK 
| iplocation IPAddress 
| search Country=China 
| stats count AS success ] 
| eval OverallSuccess = JustifiedErrors + success ]
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)
| table OverallSuccess TotalLogins Success_Ratio% 
0 Karma

justinatpnnl
Communicator

I think esix was on the right track with having you consolidate your search, you just need to use a timechart to display your results:

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real 
| iplocation IPAddress
| search Country=China
| timechart count as TotalLogins, count(eval(StatusDetails="[justified]")) as JustifiedErrors, count(eval(StatusID="OK")) as success
| eval OverallSuccess = JustifiedErrors + success
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)

esix_splunk
Splunk Employee
Splunk Employee

I believe you can consolidate these down to a more simple search..

sourcetype=clientlogs ApplicationIdentifier=AndroidTrader ActionString=#5_Login_User Mode=Real StatusDetails="*" ActionString="*" StatusID="*"
| iplocation IPAddress 
| search Country=China AND StatusDetails ="[justified]" AND ActionString="#5_Login_User" AND StatusID="OK"
| stats count as TotalLogins count(StatusDetails) as JustifiedErrors count(ActionString) as TotalLogins values(StatusDetails) as success
| eval OverallSuccess = JustifiedErrors + success ]
| eval Success_Ratio%=((OverallSuccess/TotalLogins)*100)
| table OverallSuccess TotalLogins Success_Ratio% 

Since your core search is identical for sourcetype and the additional variables, you can just adjust your stats to match what you need... Appendcols / subsearches arent ideal for larger data sets, and its better to avoid where possible...

0 Karma

alexgohberg
Explorer

Hey Thanks for your answer and its good advice but it is not the info that I looked for.
I will love to Know how I can present it over Time (by _time) without loosing data.

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...