Splunk Search
Highlighted

How to convert at InfluxDB SQL query to a Splunk SPL search?

New Member

We have a FIG (fluentD/InfluxDB/Grafana) setup in which we want to change the IG part to Splunk. We have several dashboards we need to convert. A picture of 1 of them is attached. The SQL query we use is:

SELECT mean(\"value\") FROM \"dev.agent\" WHERE (\"type\" = 'traffic-stats.rxpps' OR \"type\" = 'traffic-stats.txpps') AND \"device\" =~ /$host_regex/ AND \"interface\" =~ /$interface$/ AND $timeFilter GROUP BY \"device\", \"interface\", \"type\", time($GroupBy)"

What would the SPL look like? I have fluentD pushing the data into its only index in Splunk. The index is called "sandbox"

I assume the SPL query would start with

index="sandbox" AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps") AND (device=

That's as far as I have gotten. I need to dynamical select a device and interface. I have no clue how to code the "GROUP BY" SPL equivalent.

Thanks
alt text

0 Karma
Highlighted

Re: How to convert at InfluxDB SQL query to a Splunk SPL search?

Esteemed Legend

Like this:

index="sandbox" earliest=timeFilterMinValue latest=timeFilterMaxValue AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps")
| where match(device, "HostRegExHere") AND match(interface, "InterfaceRegExHere")
| eval dev_int_type = device . "/" . interface . "/". type
| timechart span=5m mean(value) BY dev_int_type 
0 Karma