Splunk Search

Subtract input from output

indeed_2000
Motivator

Hi
I have some process that does not finish successfully, Now i want to trace them with splunk.

here is scenario:
I have wildfly that create log file. when I start wildfly this code WFLYSRV0025 appear in the log. now I want after latest time that whildfly started, splunk start to count number of "input" and "output" like below.

“Input” mean new processes start “need to store count of previous value then it always increasing ”(streamstats sum(count))
“output” means process has been finished “need to store count of previous value, this value subtract from input continuously ” (streamstats sum(count))

The goal is splunk tell me how much process still not finish. and show this on timechart.

 

here is the log:

2021-07-06 23:10:47,131 INFO [as] WFLYSRV0025: Wildfly EAP 7.0.0.GA
2021-07-06 23:11:12,197 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,187 INFO [app] output, User: anonymous
2021-07-06 23:11:12,178 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,167 INFO [app] output, User: anonymous
2021-07-06 23:11:12,159 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,149 INFO [app] output, User: anonymous
2021-07-06 23:11:12,141 INFO [app] input , time[10] User: anonymous


4 input, 3 output

In above log as you see 1 input still remain, and not finished

2021-07-06 23:30:47,131 INFO [as] WFLYSRV0025: Wildfly EAP 7.0.0.GA
2021-07-06 23:30:47,197 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,141 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,134 INFO [app] output, User: anonymous
2021-07-06 23:30:47,138 INFO [app] output, User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous

5 input, 2 output

In above log as you see 3 input still remain, and not finished

I want to show this on timechart, in each minute that show me how many input still there.

Any idea,
Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| eval wildfly=if(match(_raw,"WFLYSVR0025"),1,0)
| eval input=if(match(_raw,"input"),1,0)
| eval output=if(match(_raw,"output"),1,0)
| streamstats sum(wildfly) as wildfly
| streanstats sum(input) as input sum(output) as output by wildfly
| eval stillrunning=input-output

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| eval wildfly=if(match(_raw,"WFLYSVR0025"),1,0)
| eval input=if(match(_raw,"input"),1,0)
| eval output=if(match(_raw,"output"),1,0)
| streamstats sum(wildfly) as wildfly
| streanstats sum(input) as input sum(output) as output by wildfly
| eval stillrunning=input-output
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...