Splunk Search

## creating a report that shows indexedtime vs logged time for each hour in percentage.

Path Finder

I want to create a chart separated by hours (24hours) that shows the number of data that took more than 2 mins to be indexed (indextime-time) and converted into percent. The percent would be the total event that took over 2mins to be indexed divided by the total number of events for that hour.(for that 1 hour span)

This is the basic search I'm using to calculate the events over 2mins
index=nameoftheindex | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=120 | convert ctime(indextime) | convert ctime(time) fields sourcetype indextime time diff

Any help would be helpful. Thanks

Tags (2)
1 Solution
Legend

You can't use a where clause that eliminates all the events under 2 minutes, and then later get a percentage of the total, because you don't have the total.

Here's one way...

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

...or just ...

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| timechart avg(GT2) as PercentGreaterThan2minutes
Legend

You can't use a where clause that eliminates all the events under 2 minutes, and then later get a percentage of the total, because you don't have the total.

Here's one way...

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

...or just ...

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| timechart avg(GT2) as PercentGreaterThan2minutes
Path Finder

Thanks DalJeanis that worked. How do I add "%" at the end of PctGT2 results and also move the decimal space to places to the right?

Legend

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time
|eval PctGT2 = round(PctGT2*100,2)."%"

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...