Splunk Search

I would like to know the splunk search processing Language command which I need to use to generate the reports as listed in the attachments Report1 and Report2

sham_suri1
New Member

I would like to know the splunk search processing Language command which I need to use to generate the reports as listed in the attachments Report1 and Report2

Tags (1)
0 Karma

DalJeanis
Legend

In order to help you figure this out, you are going to have to find out where the data is stored. If the data is already being loaded into splunk, then you will need to find the index and sourcetype, and the format of the records. Assuming that the index was foo and the sourcetype was bar, you could look at the first few records like this...

index=foo sourcetype=bar | head 100

Review the records and determine what the names are of the individual fields that will make up the report statistics. For instance, the first line says there were 2.7 million waits that took a total of 7267.7 seconds. That's about 2 hours nominal time, and it says it's 30% of the database time, so let's assume the report covers an hour on a multiple (8?) core machine.

This could be literally 2.7 million records, one for each wait, or it could be 50k records, one per process, or it could be one record per second. Find out as above, and find out what form these events that report the statistics arrive in.

Figure out what an event that reports a db file sequential read looks like, and a db file scattered read, and so on. Identify, one by one, the source for each line in teh top 10 foreground events report. Columns 1,2,3, and 6 are required. Columns 4 and 5 will be calculated.

Then report back here with those formats.

Do the same for the other report, although I have no idea what the source for that will look like.

Now, the other possiblity is that the data is NOT already in splunk, in which case you will need to find out where it is, and then we can tell you how to get it loaded. For instance, you may use dbconnect to pull it from the database, or you may use an external process to load it somewhere that splunk can ingest it. There are many options, depending on what you find.

0 Karma

p_gurav
Champion

Can you provide sample _raw data your getting into splunk?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...