Splunk Search

How to create a Splunk search for the following problem?

kc_prane
Communicator

 My base search  PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY | eval sla= (countofpases/totalcount)*100 | table sla

 

I wanted to include all the PAGE_ID and the also use the criteria for the PAGE_ID=DGEFH  and  PAGE_ID =RGHJH

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The PAGE_ID field is not available to the table command because it was removed by the stats command.  The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases.  You could make PAGE_ID available by including it in the stats command.

PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| eval timeinsecs= round((TRAN_TIME_MS/1000),2) 
| stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID 
| eval sla= (countofpases/totalcount)*100 
| table PAGEID sla

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Communicator

Hi @richgalloway 

Thanks for the response but i was looking for the results which gets  PAGE_ID=* and  the subsearch 

"PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I explained why PAGE_ID are not in the results and offered one way to include it.

The original query already includes the specified search string (not a subsearch).  How is it not meeting expectations?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...