Splunk Search

Splunk queries

saidAb
Explorer

Hi all,

A query, can calculate http calls, success responses and error response. I need an addition to the  query to get how many requests are without response. I mean calls - success_respnses - erros_rsponse = null_responses.

Some good idea bout this? Thanks in advance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck

          | fillnull value=0 backend_time

          | stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error
| eval "No response"=Calls-Success-Error

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @saidAb ,

if you could share your search, it's easier to help you, anyway, I suppose that you are using eval instats, in this case, add the total count of events and calcuate as difference from this value.

e.g.

<your_search>
| stats
    count(eval(status="success")) success_count
    count(eval(status="failed")) failed_count
    count
| eval others=count-success_count-failed_count

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends on your data. Please can you share some sample anonymised represntative events in a code block so we can see what you are dealing with.

0 Karma

saidAb
Explorer

Thank you very match fro helping me!

This works now fine!

Have nice day!

0 Karma

saidAb
Explorer

index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck

          | fillnull value=0 backend_time

          | stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error

E.g.

On the resuts, I see:  Calls 27; Success 11; Error 6

I need also to see in the results, that there was no responses for 10 calls (null_resposes) as well. 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="xxxx" sourcetype="xxxxx" message.request_path!=*/healthCheck

          | fillnull value=0 backend_time

          | stats count(eval('message.direction'="request")) as Calls, count(eval('message.response_code'="200")) as Success, count(eval('message.response_code'!="200")) as Error
| eval "No response"=Calls-Success-Error

saidAb
Explorer

Super! Thanks!

0 Karma

saidAb
Explorer

Thanks!

This works partially very good. It provides in the results all calls, success, errors and no_responses (for the calls where no_response happens) . However it ignores other calls where requests and responses are equal.

0 Karma

saidAb
Explorer

Resolved. It works now correctly. I added 'by ...' and I see all the results.

Thank you very match!!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @saidAb ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

saidAb
Explorer

Gratie Giuseppe!

See you next time!

Have a nice day.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...