Splunk Search

How to use eval with mstats

nouraali
Explorer
Hi,

I want to run something similar to the below on metrics data stored in metrics index, can you please assist:
eval ip34 = if(ip=="37.25.139.34",1,0) ,ip35 = if(ip=="37.25.139.35",1,0)
| mstats sum(ip34) , sum(ip35) ,
         avg(bytes) , stdev(bytes) , median(bytes) 
         avg(response_time_s) , stdev(response_time_s) , median(response_time_s) 
  where index=sfp_metrics earliest=-5m@m latest=@m span=1m by uri

 It gives me:

nouraali_0-1629275967777.png

Any idea how to achieve this would be appreciated.

 

Best Regards,

Labels (1)
Tags (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @nouraali 

Never tried mstats your SPL need a change, try this 

| mstats count(eval(ip=="37.25.139.34")) as ip34 , count(eval(ip=="37.25.139.35")) as ip35 ,
         avg(bytes) , stdev(bytes) , median(bytes) 
         avg(response_time_s) , stdev(response_time_s) , median(response_time_s) 
  where index=sfp_metrics earliest=-5m@m latest=@m span=1m by uri 
| eventstats sum(ip34) as ip34, sum(ip35) as ip35 by uri 
| table ip* avg* std* med* uri

 

Tags (2)
0 Karma

nouraali
Explorer

This gives me the below errors:

nouraali_0-1629364286710.png

 

0 Karma

venkatasri
SplunkTrust
SplunkTrust

| mstats seems doesn't support stats style eval aggr functions. How about changing to stats?

index=sfp_metrics earliest=-5m@m latest=now
| bin span=1m _time
| stats count(eval(ip=="37.25.139.34")) as ip34, count(eval(ip=="37.25.139.35")) as ip35,avg(bytes),stdev(bytes),median(bytes),avg(response_time_s),stdev(response_time_s),median(response_time_s) by _time, uri 
| eventstats sum(ip34) as ip34, sum(ip35) as ip35 by uri 
| table ip* avg* std* med* uri 
0 Karma

nouraali
Explorer

This works only on events index, while the data i am searching is stored in metrics index.

nouraali_0-1630057871689.png

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...