Splunk Search

Splunk sub search

Sriram
Communicator

I have a splunk query to combine 2 different results.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" 

I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Tags (2)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

Sriram
Communicator

filter works ! Awesome ! thanks for your help.

0 Karma

wpreston
Motivator

Your subsearch doesn't have the AvgRespTime>6 condition in it, so the subsearch will return events of all AvgRespTimes. Add that condition into your subsearch and it should work.

I'm thinking you might be able to refactor your search as well so that it doesn't need a subsearch at all. Would this work for you?

index=applogs sourcetype=appsource  "AvgRespTime" > 6 "performance metrics" OR "component metrics"     
| eval Statistics=if(searchmatch("performance metrics"), requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds.", componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds.")
| table Statistics
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...