Splunk Search

How to create a Splunk search for the following problem?

kc_prane
Communicator

 My base search  PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY | eval sla= (countofpases/totalcount)*100 | table sla

 

I wanted to include all the PAGE_ID and the also use the criteria for the PAGE_ID=DGEFH  and  PAGE_ID =RGHJH

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The PAGE_ID field is not available to the table command because it was removed by the stats command.  The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases.  You could make PAGE_ID available by including it in the stats command.

PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| eval timeinsecs= round((TRAN_TIME_MS/1000),2) 
| stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID 
| eval sla= (countofpases/totalcount)*100 
| table PAGEID sla

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Communicator

Hi @richgalloway 

Thanks for the response but i was looking for the results which gets  PAGE_ID=* and  the subsearch 

"PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I explained why PAGE_ID are not in the results and offered one way to include it.

The original query already includes the specified search string (not a subsearch).  How is it not meeting expectations?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...