Splunk Search

Splunk sub search

Sriram
Communicator

I have a splunk query to combine 2 different results.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" 

I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Tags (2)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

Sriram
Communicator

filter works ! Awesome ! thanks for your help.

0 Karma

wpreston
Motivator

Your subsearch doesn't have the AvgRespTime>6 condition in it, so the subsearch will return events of all AvgRespTimes. Add that condition into your subsearch and it should work.

I'm thinking you might be able to refactor your search as well so that it doesn't need a subsearch at all. Would this work for you?

index=applogs sourcetype=appsource  "AvgRespTime" > 6 "performance metrics" OR "component metrics"     
| eval Statistics=if(searchmatch("performance metrics"), requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds.", componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds.")
| table Statistics
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...