Splunk Search

foreach and fit

pjohnson1
Path Finder

I have a timechart with more than 1 time series and would like to run the fit command on each of the time series separately.

Is this possible with foreach or is another approach needed?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Another approach is needed. What are you actually trying to achieve (ideally from the raw events rather than assume timechart is the place to start)?

0 Karma

pjohnson1
Path Finder

The events contains ifHCInOctets counters for switch ports which I calculate the bandwidth.

{"timestamp": "2021-05-01T00:40:02", "device": "switch1", "port_id": "1/0/g2", "port_alias": "LONDON1_Gi1_0_2", "port_type": "network", "ifHCInOctets": "386349938202882"}

By specifying a specific switch port (port_id=1/0/g2), I am able to fit the time series to an algorithm but this approach is not scalable.

index=main sourcetype=_json port device=switch1 port_alias=LONDON* port_id=1/0/g2
| streamstats window=1 global=f current=f last(ifHCInOctets) as last_in by port_id 
| eval in_change = last_in - ifHCInOctets 
| where in_change>=0 
| eval inMbps=in_change*8/1000/1000
| eval c_time=strftime(_time,"%m/%d/%y %H:%M:%S")
| timechart span=15m per_second(inMbps) by port_id
| eval date_minutebin=strftime(_time, "%M")
| eval date_hour=strftime(_time, "%H")
| eval date_wday=strftime(_time, "%A")
| fit DensityFunction 1/0/g2 by "date_minutebin,date_hour,date_wday" into switch1_1_0_g2 threshold=0.05 dist=norm

I would like to fit multiple switch ports (port_id=1/0/g*) into each of their seperate models in one search.

Then afterwards, I would like to apply multiple switch port models to their new respective time series data (using the same approach?).

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...