I would like to know the splunk search processing Language command which I need to use to generate the reports as listed in the attachments Report1 and Report2

[sham_suri1]

I would like to know the splunk search processing Language command which I need to use to generate the reports as listed in the attachments Report1 and Report2

[DalJeanis]

In order to help you figure this out, you are going to have to find out where the data is stored. If the data is already being loaded into splunk, then you will need to find the index and sourcetype, and the format of the records. Assuming that the index was foo and the sourcetype was bar, you could look at the first few records like this...

index=foo sourcetype=bar | head 100

Review the records and determine what the names are of the individual fields that will make up the report statistics. For instance, the first line says there were 2.7 million waits that took a total of 7267.7 seconds. That's about 2 hours nominal time, and it says it's 30% of the database time, so let's assume the report covers an hour on a multiple (8?) core machine.

This could be literally 2.7 million records, one for each wait, or it could be 50k records, one per process, or it could be one record per second. Find out as above, and find out what form these events that report the statistics arrive in.

Figure out what an event that reports a db file sequential read looks like, and a db file scattered read, and so on. Identify, one by one, the source for each line in teh top 10 foreground events report. Columns 1,2,3, and 6 are required. Columns 4 and 5 will be calculated.

Then report back here with those formats.

Do the same for the other report, although I have no idea what the source for that will look like.

Now, the other possiblity is that the data is NOT already in splunk, in which case you will need to find out where it is, and then we can tell you how to get it loaded. For instance, you may use dbconnect to pull it from the database, or you may use an external process to load it somewhere that splunk can ingest it. There are many options, depending on what you find.

[p_gurav]

Can you provide sample _raw data your getting into splunk?