Splunk Search

How to edit my search to show the count and percentage per id for each day?

guillecasco
Path Finder

Hey.

I'm quite new with Splunk and learning for the moment. I need to show a table with " Time id count percentage "
For the last 15 days, I need to know the count of backend calls per id for each day.
I already extracted the Ids from a json file and now just need to show them as the way I described.

I'm trying some things I only have this search:

index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |timechart span=1d count by asset_data{}.id 

but it doesn't show me what I want. It just shows a table with field time and the name of each asset id in other field with the counts of each search on backend like this:

time   id12345  1269785  id9874   
4/11      85       29       5          
4/12      67       35       7    
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data  | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id  as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2) 
| table _time id count percentage

View solution in original post

somesoni2
Revered Legend

Try something like this

index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data  | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id  as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2) 
| table _time id count percentage

guillecasco
Path Finder

I missunderstood the question. Didn't have to put 15 rows for the 15 last days, Just look up in the logs of the last 15 days and extract that information. So final query (With your help somesoni2) is

index=updtr_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |stats count by asset_data{}.id | rename asset_data{}.id  as id|eventstats sum(count) as total| eval percentage=round(count*100/total) |table id count percentage

thank you!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It'd help if you provided some sample data along with a sketch of what your results table should look like.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...