Splunk Search

How to use stats() by one value, "all" and stats() by each selected value ?

Jouman
Path Finder

Hi all,

I want to analyze the Round Trip Time and received count in Ping command for each ping packet size or for all packets.

Therefore, I use stats() as below:

 

<my basic search> `comment("generate ping_rtt_time for round trip time, ping_rcv_count for received packet count")`
| stats min(ping_*) as min_ping_*, max(ping_*) as max_ping_*, avg(ping_*) as avg_ping_*, perc20(ping_ping_*) as pr20_ping_*, perc40(ping_*) as pr40_ping_*, stdev(ping_*) as stdev_ping_* by ping_packet_size

 

 
Therefore if the user selects multi-ple packet size, ex, 40, 128 bytes, the related analysis can be provided.

But if a user wants to read analysis for all packets, that means he want to analyze all  packet size, ex, All, I can't use the same stats().
If there are 2 kinds of packet size, ex. 40 , 128 bytes, it is different between selecting 40 and 128 options in a scroll down bar with selecting "All" in the same scroll down bar.

Does anyone know how to analyze for one or multi-ple packet size and for all kinds of packet size as well ?

Thank you.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats min(ping_*) as min_ping_*_all, max(ping_*) as max_ping_*_all, avg(ping_*) as avg_ping_*_all, perc20(ping_*) as pr20_ping_*_all, perc40(ping_*) as pr40_ping_*_all, stdev(ping_*) as stdev_ping_*_all
| stats min(ping_*) as min_ping_*, max(ping_*) as max_ping_*, avg(ping_*) as avg_ping_*, perc20(ping_*) as pr20_ping_*, perc40(ping_*) as pr40_ping_*, stdev(ping_*) as stdev_ping_* max(min_ping_*_all) as min_ping_*_all, max(max_ping_*_all) as max_ping_*_all, max(avg_ping_*_all) as avg_ping_*_all, max(pr20_ping_*_all) as pr20_ping_*_all, max(pr40_ping_*_all) as pr40_ping_*_all, max(stdev_ping_*_all) as stdev_ping_*_all by ping_packet_size
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...