Splunk Search
Highlighted

Splunk sub search

Communicator

I have a splunk query to combine 2 different results.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" 

I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

Tags (2)
Highlighted

Re: Splunk sub search

Motivator

Your subsearch doesn't have the AvgRespTime>6 condition in it, so the subsearch will return events of all AvgRespTimes. Add that condition into your subsearch and it should work.

I'm thinking you might be able to refactor your search as well so that it doesn't need a subsearch at all. Would this work for you?

index=applogs sourcetype=appsource  "AvgRespTime" > 6 "performance metrics" OR "component metrics"     
| eval Statistics=if(searchmatch("performance metrics"), requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds.", componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds.")
| table Statistics
Highlighted

Re: Splunk sub search

SplunkTrust
SplunkTrust

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

View solution in original post

Highlighted

Re: Splunk sub search

Communicator

filter works ! Awesome ! thanks for your help.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.