Splunk Search

Splunk sub search

Sriram
Communicator

I have a splunk query to combine 2 different results.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" 

I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Tags (2)
1 Solution

somesoni2
Revered Legend

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

View solution in original post

somesoni2
Revered Legend

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

Sriram
Communicator

filter works ! Awesome ! thanks for your help.

0 Karma

wpreston
Motivator

Your subsearch doesn't have the AvgRespTime>6 condition in it, so the subsearch will return events of all AvgRespTimes. Add that condition into your subsearch and it should work.

I'm thinking you might be able to refactor your search as well so that it doesn't need a subsearch at all. Would this work for you?

index=applogs sourcetype=appsource  "AvgRespTime" > 6 "performance metrics" OR "component metrics"     
| eval Statistics=if(searchmatch("performance metrics"), requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds.", componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds.")
| table Statistics
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...