Splunk Search

How to extract "seconds" and "documents" fields from each event, chart the average of seconds/document, and alert if the average is greater than 1?

MikeBertelsen
Communicator

Trying to get an alert from Splunk when an average for a specified time and number of documents > 1.
Example taken for this event:
TIME TAKEN : 2.59 second(s) , NO OF DOCS : 3

2.59/3 =.86333 seconds per document

We want to track if the value is 1 second per document.
Once we have that, if the trend is that this value continues to climb over, we want another alert to warn us of a potential memory leak.

Any help appreciated.

0 Karma

woodcock
Esteemed Legend

Try this:

| rex "TIME TAKEN : (?<seconds>\S+).*NO OF DOCS : (?<documents>\d+)" | eval docsPerSecond = documents/seconds | where docsPerSecond > 1 | timechart span=1h avg(docsPerSecond)
0 Karma

chimell
Motivator

Hi MikeBertelsen
Run the query that Woodcock gave you . Save it as alert by filling the important field

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...