Splunk Search

get size/bytes of log events and the number events by direction (request/response)

edookati
Path Finder

I am trying to get the number of requests/response that we send/receive to/from one application and the combined size of request & responses per hour.

I am using the below query, but this doesn't seem to work.

index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eventstats sum(raw_len), count by date_hour, Direction

I need results in the below table format...

date.hour NumberofRequests(direction=REQUEST) Number of Responses (direction=RESPONSE) Sum(bytes)

Can someone please help me with this?
Thanks.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize

View solution in original post

edookati
Path Finder

great! it worked. Thanks a lot.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.