Splunk Search

How to combine multiple complicated searches?

s0rbeto
Explorer

Hi everyone,

I have these 3 searches, and they are all complicated as it looks. Any idea on how to combine them? It's not something regular eval can do though, My thought is to put them into tables maybe?

index=websphere CPUStarvation
| rex "delay is\s+(?P<Value>\d+)\s+seconds" 
| eval Value=Value . " Seconds"
| eval AlertName = "APM WAS: CPU Starvation detected"
| eval Severity="Critical" 
| eval Details = "APM WAS: Error HMGR0152W. Value Field represent thread scheduling delay"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM

index=websphere OutOfMemoryError 
| rex mode=sed field=_raw "s/\n.*//g" 
| rex mode=sed field=_raw "s/^\[.*PDT\]\s+.{8}\s+//g" 
| eval ts=round(_time,0) 
| stats count as Value list(_raw) as msg by ts,host 
| convert ctime(ts) as dt
| eval AlertName = "APM WAS: OutOfMemoryError"
| eval Severity="Critical" 
| eval Details = "OutOfMemoryError"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM

index=websphere HangingThreat
| rex "active for\s+(?P<Value>\d+)\s+milliseconds.*are\s+(?P<threads>\d+)\s+thread" 
| eval Value=round(Value/1000,2)
| eval Value=Value . " Sec"
| eval AlertName = "APM WAS: WAS Hanging Threads"
| eval Severity="Critical" 
| eval Details = "APM WAS: Error WSVR0605W (".threads." Threads hang). Field 'Value' represent thread activity time"
| table AlertName,Details,Severity,Value,host
| collect index=alerts sourcetype=Alerts:APM

thank you

Tags (2)
0 Karma

NOUMSSI
Builder

Hi,
try this

| multisearch [search index=websphere CPUStarvation
 | rex "delay is\s+(?P<Value>\d+)\s+seconds" 
 | eval Value=Value . " Seconds"
 | eval AlertName = "APM WAS: CPU Starvation detected"
 | eval Severity="Critical" 
 | eval Details = "APM WAS: Error HMGR0152W. Value Field represent thread scheduling delay"
 | table AlertName,Details,Severity,Value,host
 | collect index=alerts sourcetype=Alerts:APM

]

[search index=websphere OutOfMemoryError 
 | rex mode=sed field=_raw "s/\n.*//g" 
 | rex mode=sed field=_raw "s/^\[.*PDT\]\s+.{8}\s+//g" 
 | eval ts=round(_time,0) 
 | stats count as Value list(_raw) as msg by ts,host 
 | convert ctime(ts) as dt
 | eval AlertName = "APM WAS: OutOfMemoryError"
 | eval Severity="Critical" 
 | eval Details = "OutOfMemoryError"
 | table AlertName,Details,Severity,Value,host
 | collect index=alerts sourcetype=Alerts:APM

]

[search index=websphere HangingThreat
 | rex "active for\s+(?P<Value>\d+)\s+milliseconds.*are\s+(?P<threads>\d+)\s+thread" 
 | eval Value=round(Value/1000,2)
 | eval Value=Value . " Sec"
 | eval AlertName = "APM WAS: WAS Hanging Threads"
 | eval Severity="Critical" 
 | eval Details = "APM WAS: Error WSVR0605W (".threads." Threads hang). Field 'Value' represent thread activity time"
 | table AlertName,Details,Severity,Value,host
 | collect index=alerts sourcetype=Alerts:APM

]

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...