Splunk Search

Unable to fetch result of hosts which are not having any activity from last 60 mins

sahil237888
Path Finder

Hi Team,

I am trying to fetch the count and percentage of hosts having success and failures along with failure percentage.

host =
Server1
Server2
Server3
Server4
Server5


But if count of spcecific host is having no event, I want to show that as well even with result =0.

I am running below query but it is missing some servers because there are no events on specific sevrers form last 2 hours.

index=server_list host IN (Server1,Server2,Server3,Server4,Server5) events_status = "*"
| eval pass=if(like(event_status,"20%"),1,0)
| eval fail=if(!like(event_status,"20%"),1,0)
| stats count as Overall_Volume,sum(pass) as Passed, sum(fail) as Failed by host
| eval Failure_Rate=round(Failed_Requests/(Passed_Requests+Failed_Requests)*100,2)
| fillnull value=0

Below result I am getting, because Server4 and Server5 dont have any traffic from last 2 Hours -

host          Overall_Volume Passed Failed Failure_Rate
Server1       2                              1                1            50
Server2      10                             6               4            40
Server3       1                               0               1            100

 

Can anyone help in query so that I should get all Servers with values as 0 if no traffic.

 

 

 

Labels (1)
0 Karma

PickleRick
Ultra Champion

I don't know if there's a FAQ here, but this kind of question should definitely be there (I answered similar one few days ago).

Splunk's works by passing from each step to the next one a set of records (events, stats). But it doesn't know where this data comes from (what was the command which resulted in this data).

So if you tell it to search for events fulfilling a given set of conditions during given timerange, it does so. But if some of those conditions can't be fulfilled, they simply don't produce any events but splunk doesn't know further down the road what the conditions were.

Thus if you want to have the rows saying that some hosts have 0 stats, you have to prepare such records yourself.

See https://community.splunk.com/t5/Splunk-Search/Need-to-display-count-having-zero-events/m-p/565220

0 Karma

sahil237888
Path Finder

Hi @PickleRick -

this query is giving 0 for each server even if there is traffic on that server.

Can you suggest any other query?

0 Karma

PickleRick
Ultra Champion

Well, of course the query on its own will give you results of 0. You have to append your own results and sum them up. That's the point.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...