Splunk Search

eventtypes identification



I have created 21 eventypes for my requirement.In tat 21 eventypes when i write a query only few eventtypes are involved . how do we indentify those eventtypes ?? and after identifying the eventtypes i need to print a table which shows the time duration taken for each eventype.

for Example assuse I have 21 eventtypes with names A,B,C,D...U .My requirement is i need to pass a searchparameter to a searchquery , which on excuting only involves few eventypes ..i need to indentify them and print the dimension duration spent for each eventype.assue A,B and D are the eventtypes involved for my searchquery with the given searchparameter value..

Now i need the table like this.

SearchParameter A B D

AAA 34 45 45

where A,B,D are the involved eventypes for the searchquery with searchparameter "AAA" and 34,45,45 are the duration time in secs spent at eventtype..Please reply asap.Thnx in advance..

Tags (2)
0 Karma


Here is a possible starting point, updated based on first comment:

yoursearchhere |
eval etype = case(eventtype=="eventtype1","eventtype1",eventtype="eventtype2","eventtype2") |
stats count by etype

This creates a new field called etype, which is set to one of the applicable eventtypes. This will work great, if you are only interested in a few of the eventtypes, and if the eventtypes do not overlap.

However, this does not calculate a "duration." You didn't give enough information for me to suggest how to do that.

I would suggest that you work this through with a particular search parameter, and when you are happy with the output - save the search as a macro. As a macro, you could do the parameter substitution that I think you ultimately want.

0 Karma


i have used this . but then its displaying all the eventtypes .but i need only specfic eventtypes to display..ie the eventtypes which are involved for that particular search query

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...