Working with stat log events from DJB's dnscache. These look like:
@400000004f3ebb59244cc72c stats 275245265 10318311576 81 0
The first field is timestamp in tai64nlocal. Splunk deals with that. The first field after the 'stats' string is a query counter, constantly incrementing. To get querys/second for the DNS resolver, I can do:
index=dns earliest=-1m host=dns1 | rex field=_raw "stats\s(?<querycount>\d+) " | stats max(querycount) as hq,min(querycount) as lq | eval qps=(hq-lq)/60 | table host,qps,hq,lq
What I'd like to do is search against the index and execute stats and eval against values retrieved from each host observed in the index, without creating a separate search for each host. I've been thinking something along the lines of finding hosts in a subsearch then for each value returned, execute the search to gather statistics.
I'm sure someone has done something cool like this before.
You can use chart
and then eval()
stuff directly inside of it, so something like this should work:
index=dns earliest=-1m host=dns1 | rex field=_raw "stats\s(?<querycount>\d+) " | chart eval((max(querycount)-min(querycount))/60) as qps,max(querycount) as hq,min(querycount) as lq by host
Both answers work great, thanks!
index=dns earliest=-1m host=dns1
| rex field=_raw "stats\s(?<querycount>\d+) "
| stats max(querycount) as hq,
min(querycount) as lq
by host
| eval qps=(hq-lq)/60
The "by" clause of the stats
command does what you want.
You can use chart
and then eval()
stuff directly inside of it, so something like this should work:
index=dns earliest=-1m host=dns1 | rex field=_raw "stats\s(?<querycount>\d+) " | chart eval((max(querycount)-min(querycount))/60) as qps,max(querycount) as hq,min(querycount) as lq by host