Splunk Search

Looping in Splunk...

sjringo
Contributor

Trying to figure out how to loop in Splunk.  I have the below query and my end result is to map/chart into a timechart by the percentage over _time.

index=anIndex sourcetype=aSource StringA earliest=-480m latest=-240m | stats count as A

| appendcols [search index=anIndex sourcetype=aSouce StringB earliest=-480m latest=-240m | stats count as B ]

| eval _time = relative_time(now(), "-240m@m")

| eval percentage = round(( A / B) * 100)

| fields + _time, percentage

 

Variables that need to change with each loop.

Lets assume I want to show percentage starting from 4 hour in the past to the current time by 30 minute increments.

1) Index: the earliest and latest need to increment by +30 minutes starting at (latest=-480, earliest = -240) till I get to 0

2) _time will need to be relative to when I start (beginning @ time now(), -240) and be adjusted on each loop by + 30 mins till I get to 0

 

I have looked at many examples but do not understand how to apply it to my requirements...

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try removing that line

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

SPL is not a procedural language so we have to think a little differently to get the job done.  Fortunately, it can do looping for us.

index=anIndex sourcetype=aSource (StringA OR StringB) earliest=-480m latest=-240m 
| bucket span=30m _time
| stats sum(eval(like(_raw, "%StringA%"))) as A, sum(eval(like(_raw, "%StringB%"))) as B by _time
| eval percentage = round(( A / B) * 100)
| fields _time, percentage
---
If this reply helps you, Karma would be appreciated.
0 Karma

sjringo
Contributor

Pseudo code, mixture of Java and SPL:

 

int aSpan = 240;   <- 4 hours

for (int anInt = -510; anInt > 0; anInt -30) {

 

              index=anIndex sourcetype=aSourceType StringA earliest=-(anInt)m latest=-(anInt+aSpan)m | stats count as A

              | appendcols [search index=anIndex sourcetype=aSourceType StringB -(anInt)m latest=-(anInt+aSpan)m | stats count as B ]

              | eval _time = relative_time(now(), "-(anInt)m@m")

              | eval percentage = round((A / B) * 100)

              | + fields _time, percentage   

}

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's again the https://community.splunk.com/t5/Splunk-Search/Timechart-of-a-percentage-using-data-from-X-hours-ago/... topic? 🙂

I still think you're not telling us what you want to achieve but what you're trying to force splunk to do.

I understand that you want to calculate some stats based on how many times StringA appears in events with sourcetype=A and how many times StringB appears in events with sourcetype=B.

But what is the desired result. Tell us what is this supposed to represent.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

index=anIndex sourcetype=aSource StringA earliest=-480m latest=-240m
| bin _time span=30m
| stats count as A

| appendcols [search index=anIndex sourcetype=aSouce StringB earliest=-480m latest=-240m 
| bin _time span=30m
| stats count as B ]

| eval _time = relative_time(now(), "-240m@m")

| eval percentage = round(( A / B) * 100)

| fields + _time, percentage
0 Karma

sjringo
Contributor

I added ( | bin _time span=30m) and the results were one percentage calculation.  What I am looking for is the percentage calculation over time .  I am looking for results like this, lets assume we run the query at 4 AM.  Starting @ midnight then moving forward till we get till 4 AM.

_time                                                Percentage                               earliest                           latest

2021-10-07 00:00:00                P1                                                 -480                                -240

2021-10-07 00:30:00                P2                                                 -450                                -210

2021-10-07 01:00:00                P3                                                 -420                                -180

2021-10-07 04:00:00                PX                                                 -240                                -0

Then I would use the timechart on ( _time, Percentage) which would show me how the percentage moves up/down every 30 mins from midnight till 4 AM.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry I missed the by _time out

index=anIndex sourcetype=aSource StringA earliest=-480m latest=-240m
| bin _time span=30m
| stats count as A by _time

| appendcols [search index=anIndex sourcetype=aSouce StringB earliest=-480m latest=-240m 
| bin _time span=30m
| stats count as B by _time]

| eval _time = relative_time(now(), "-240m@m")

| eval percentage = round(( A / B) * 100)

| fields + _time, percentage
0 Karma

sjringo
Contributor

Much, Much better...  One thing is that _time is the same for each percentage result, which makes sense since the _time eval is:

| eval _time = relative_time(now(), "-240m@m")

How would I make it move in 30 minute intervals which is the bin span ? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try removing that line

sjringo
Contributor

That did the trick.  Once again thanks for your help!

My procedural brain was just not seeing the problem correctly...

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, SPL is not procedural, although there are ways to do loops of a sort, but they wouldn't have helped in your case.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...