Splunk Search

Transactions: summing up repeated fields

Influencer

I have server farms made up of 4 servers each. I have various stats from each posted once per minute. I want to group them together based on their farm, sum up their stats for each minute, then be able to perform more analysis (perc95, avg, etc) on those aggregated values.

Eg:

12:34:50 host=server1 farm=1 bps=1000 hps=10
12:34:51 host=server2 farm=1 bps=900 hps=9
12:34:51 host=server3 farm=1 bps=1100 hps=10
12:35:02 host=server4 farm=1 bps=1000 hps=9

Combine that into one event using transaction

| transaction farm maxspan=59s

But I need to create a totalBps field equal to 4000 and a totalHps field equal to 38. Then I'd be able to run something like:

| stats perc95(totalBps) by farm

I haven't been able to wrap my head around what's needed to make that possible.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

You don't need transaction. Grouping is best done by stats or timechart, not transaction.

sourcetype=mystatsdata 
| bucket _time span=1m 
| stats sum(bps) as totalbps sum(hps) as totalhps
  by _time,farm 
| stats 
    perc95(totalbps) 
    perc95(totalhps) 
    median(totalhps)
  by farm

View solution in original post

Splunk Employee
Splunk Employee

You don't need transaction. Grouping is best done by stats or timechart, not transaction.

sourcetype=mystatsdata 
| bucket _time span=1m 
| stats sum(bps) as totalbps sum(hps) as totalhps
  by _time,farm 
| stats 
    perc95(totalbps) 
    perc95(totalhps) 
    median(totalhps)
  by farm

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!