Splunk Search

compare todays time duration with 30 days time duration.If if exceeds threshold(1.2*30days avg)send email alert,compare current Job duration with last 30 days average.If its exceeds threshold(1.2*30 days avg) send an email alert

thomaap
New Member

PROBLEM DESCRIPTION:compare todays time duration with 30 days time duration.If if exceeds threshold(1.2*30days avg)send email alert
PLEASE FIND BELOW QUERY.However i see a discrepancy in the 30 days average for jobs exceeding 60 minutes.Can you advise if i am missing a step

index=MY_INDEX sourcetype=foo JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold

,Please find below query.However i see that the average calculated for jobs running over an hour appears to be wrong

index=MY_INDEX sourcetype=autosys_demon* JOB="JOBNAME" earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold

0 Karma

thomaap
New Member

reposting query
index=MY_INDEXsourcetype=autosys_demon* JOB=JOBNAME earliest= -30d@d latest= now()
|dedup JOB,STATUS
| eval startTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="RUNNING",strftime(_time, "%a %B %d %Y %H:%M:%S")),endTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="SUCCESS",strftime(_time, "%a %B %d %Y %H:%M:%S")), terminateTime= case("0"!=(strftime(_time, "%a %B %d %Y %H:%M:%S")) AND STATUS="TERMINATED",strftime(_time, "%a %B %d %Y %H:%M:%S"))
| eval sTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eval eTime=strptime(endTime,"%a %B %d %Y %H:%M:%S")
| eval tTime=strptime(startTime,"%a %B %d %Y %H:%M:%S")
| eventstats latest(STATUS) AS STATUS BY JOB
| transaction JOB,startTime,endTime
| eval e_Time=if(STATUS="TERMINATED" OR eTimeThreshold

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...