Splunk Search

Splunk Stats Table - Color coding the rows if the value changes by a certain percentage

jagadeeshm
Contributor

I have a Kafka Monitor that generates events every minute (~approx) about production and consumption rates per second.

Sample Event

{
 "CONSUMER_RATE":"0.09",
 "TOTAL_LOG_SIZE":"2171258",
 "GROUP":"consumer_group_1",
 "MSG_RATE":"0.08",
 "CLUSTER":"New_York"
}

The events are generated per CLUSTER per GROUP. MSG_RATE indicates the production rate and CONSUMER_RATE indicates consumption rate.

For each CLUSTER/GROUP, I want to display the latest (most recently received events) production rate and consumption rate and color code the rows if the consumption rate is falling behind production rate by a pre-defined percentage over last X number of intervals.

If color coding is not possible, I only want to display the CLUSTER/GROUP that is failing above condition.

For displaying the latest events, I am deduping on CLUSTER and GROUP. Thoughts?

0 Karma
1 Solution

woodcock
Esteemed Legend

Color-coding is a hassle in versions prior to 6.5 but it is built-in starting with that version. So I would first upgrade to the latest version and then you can click on the column header and program your own logic for color coding right there. Otherwise see how to do it in this app (there is an example of it).

https://splunkbase.splunk.com/app/1603/

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try a search like this:

... | dedup CLUSTER GROUP
| eval RATIO = CONSUMER_RATE / MSG_RATE
| where RATIO < YourValueHere
| table CLUSTER GROUP MSG_RATE CONSUMER_RATE RATIO
0 Karma

jagadeeshm
Contributor

I also mentioned about the last X intervals. dedup just gives me back 1 event.

0 Karma

woodcock
Esteemed Legend

Right, but what about the rest. This answer should do it as-is. If it does not, do elaborate.

0 Karma

woodcock
Esteemed Legend

Color-coding is a hassle in versions prior to 6.5 but it is built-in starting with that version. So I would first upgrade to the latest version and then you can click on the column header and program your own logic for color coding right there. Otherwise see how to do it in this app (there is an example of it).

https://splunkbase.splunk.com/app/1603/

0 Karma

jagadeeshm
Contributor

That answers my coloring issue. What about the query part?

0 Karma

jagadeeshm
Contributor

Well, my biggest concern is to calculate the average for several intervals and then the color coding.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...