Splunk Search

Is it possible to autoregress by unique site

Amohlmann
Communicator

I get a series of unique sites sending through the size of Database. I would like to show the growth of their DB to see if it is growing too quickly.

I am currently doing this using streamstats and it works fine but is a bit messy. I feel like I could use autoregress to tidy things up, but I cannot find a way to autoregress by site ID.

My current base search leaves a table that is sorted by time but with a mix of unique sites. I would like to compare the latest result from each site with the previous result of THAT site.

Would it be possible to do something like this:

basesearch|autoregress DBSizeCurrent as DBSizePrevious by siteID p=1

This does not work, but I feel like I must be doing something wrong. Or can you not use the 'by' argument in autoregress at all?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi Amohlmann,

the autoregress docs http://docs.splunk.com/Documentation/Splunk/6.2.6/SearchReference/Autoregress do not mention anything about the usage of by.
You could use streamstats or eventstats to get the previous event, try this run everywhere command:

index=_internal kbps>=10 | streamstats current=f last(kbps) AS last_kbps last(_time) AS last_time by _time | table _time, kbps, last_time, last_kbps

You could also use the window option for streamstats if you need more than just one previous event, see docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.6/SearchReference/Streamstats

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi Amohlmann,

the autoregress docs http://docs.splunk.com/Documentation/Splunk/6.2.6/SearchReference/Autoregress do not mention anything about the usage of by.
You could use streamstats or eventstats to get the previous event, try this run everywhere command:

index=_internal kbps>=10 | streamstats current=f last(kbps) AS last_kbps last(_time) AS last_time by _time | table _time, kbps, last_time, last_kbps

You could also use the window option for streamstats if you need more than just one previous event, see docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.6/SearchReference/Streamstats

Hope this helps ...

cheers, MuS

Amohlmann
Communicator

Thanks MuS, that is what I am already doing just thought there might have been a work around for autoregress.
Guess not.

Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...