combining multiple events (LEG1 & LEG2) and putting as a macro

[koshyk]

hi Folks,
I'm fairly new to splunk. I've written a script to get logs from F5 using SNMP. The events retrieved are
- 2 events after x seconds (LEG1 & LEG2) per same messageID per F5SERVERNAME

A sample is given below

F5SERVERNAME=DENVER messageID=1383665849; LEG=2; RUNTIMEEPOCH=1383665910; sysStatHttpRequests=0; sysHostMemoryUsed=4108898304; sysStatMemoryUsed=84254856; sysStatClientCurConns=28; sysStatServerCurConns=28; 

F5SERVERNAME=DENVER messageID=1383665849; LEG=1; RUNTIMEEPOCH=1383665876; sysStatHttpRequests=0; sysHostMemoryUsed=4108128256; sysStatMemoryUsed=84262776; sysStatClientCurConns=27; sysStatServerCurConns=27;  

F5SERVERNAME=SIGMAS messageID=1383665849; LEG=2; RUNTIMEEPOCH=1383665901; sysStatHttpRequests=7816342; sysHostMemoryUsed=4109127680; sysStatMemoryUsed=85828904; sysStatClientCurConns=118; sysStatServerCurConns=118;    

F5SERVERNAME=SIGMAS messageID=1383665849; LEG=1; RUNTIMEEPOCH=1383665867; sysStatHttpRequests=7816342; sysHostMemoryUsed=4108111872; sysStatMemoryUsed=85845016; sysStatClientCurConns=113; sysStatServerCurConns=113;  

The aim is to do calculations on messages from same F5SERVERNAME with same messageID
eg MEMORY_USED_PER_SECOND=
(LEG2:sysStatMemoryUsed - LEG1:sysStatMemoryUsed ) / (LEG2:RUNTIMEEPOCH - LEG1:RUNTIMEEPOCH)

My aim is to do the calculations and put the search as a saved search or macro. So the results can be exported into csv.
I tried transaction command, but I couldn't find a name to subtract values as they have same variable names

Any help would be much appreciated.
Cheers

[yong_ly]

I'd say the best way to do this would be to rename the fields in the events where LEG=2 to be different and then transaction them together to perform the calculations.

You can do this either runtime or index time.. These would have to tested (since I don't have the data to run the tests on.

RUNTIME:

[search] | rex field=_raw "F5SERVERNAME=(?<server_1>[\S]+) messageID=(?<msgid_1>[\d]+); LEG=1; RUNTIMEEPOCH=(?<runtime_1>[\d]+); ..." |  rex field=_raw "F5SERVERNAME=(?<server_2>[\S]+) messageID=(?<msgid_2>[\d]+); LEG=2; RUNTIMEEPOCH=(?<runtime_2>[\d]+); ..." | transaction messageID | eval mem_per_sec = ((statmem_2-statmem_1)/(runtime_2-runtime_1)) 

Of course you need to put in the WHOLE regular expressions.. this should work, but it would need to be tested. Luckily it doesn't affect the underlying data so you can experiment 🙂

INDEX TIME:

create transforms in props.conf/transforms.conf to change the data before it gets indexed so the fields are renamed. There are plenty of examples online if you do a search for them.

[mbenwell · Accepted solution]

Hi Koshyk,

I think transaction is the command you want.

Have a look at the below:
http://answers.splunk.com/answers/99210/difference-of-fields-with-the-same-name-in-a-transaction

Cheers

Mat

[koshyk]

Thanks mate. The link gave me answer. Cheers