I occasionally use Splunk as part of my job to research issues, but am very much a novice. The query below charts the stored procedures and maps their average run times (and it works).
index=X sourcetype IN Y source IN Z
| spath "TotalDuration"
| search "TotalDuration"="*"
| chart avg(TotalDuration) as average over ProcName
The issue I'm running into is that the procs may be called with slight variations, such as:
sp_DoAThing
sp_doathing
[sp_doathing]
What I'd like to do is ignore case and remove brackets, so that all three of the examples above return as one proc with one average duration, instead of three. It says I don't have enough karma points to post links so I can't share the similar questions I've read through, but the answers I've seen (for ignoring case) seem as simple as,
| eval ProcName = lower(ProcName)
but I have tried that in many locations and many variations and cannot get it to work. Any help would be greatly appreciated.
You're on the right track with lower
to normalize case. I'm interested in what you get when you try it.
Removing brackets is done with the trim
function.
index=X sourcetype IN Y source IN Z
| spath "TotalDuration"
| search "TotalDuration"="*"
| eval ProcName=trim(lower(ProcName),"[]")
| chart avg(TotalDuration) as average over ProcName
You're on the right track with lower
to normalize case. I'm interested in what you get when you try it.
Removing brackets is done with the trim
function.
index=X sourcetype IN Y source IN Z
| spath "TotalDuration"
| search "TotalDuration"="*"
| eval ProcName=trim(lower(ProcName),"[]")
| chart avg(TotalDuration) as average over ProcName
Once I figured out the single quote issue above your solution worked great! Thank you!
For some reason this doesn't work for me:
| eval ProcName = lower(ProcName)
It tells me no results are found. I simplified the Proc Name field for the purposes of asking the question. The actual field name is more like:
| eval A.B.C = lower(A.B.C)
Is it possible the periods are messing with it?
Yup... that was it. I needed to put single quotes around it.