Splunk Search

How to create a Splunk search for the following problem?

kc_prane
Communicator

 My base search  PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY | eval sla= (countofpases/totalcount)*100 | table sla

 

I wanted to include all the PAGE_ID and the also use the criteria for the PAGE_ID=DGEFH  and  PAGE_ID =RGHJH

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The PAGE_ID field is not available to the table command because it was removed by the stats command.  The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases.  You could make PAGE_ID available by including it in the stats command.

PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| eval timeinsecs= round((TRAN_TIME_MS/1000),2) 
| stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID 
| eval sla= (countofpases/totalcount)*100 
| table PAGEID sla

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Communicator

Hi @richgalloway 

Thanks for the response but i was looking for the results which gets  PAGE_ID=* and  the subsearch 

"PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I explained why PAGE_ID are not in the results and offered one way to include it.

The original query already includes the specified search string (not a subsearch).  How is it not meeting expectations?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...