- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
edookati
Path Finder
05-06-2015
11:52 AM
I am trying to get the number of requests/response that we send/receive to/from one application and the combined size of request & responses per hour.
I am using the below query, but this doesn't seem to work.
index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eventstats sum(raw_len), count by date_hour, Direction
I need results in the below table format...
date.hour NumberofRequests(direction=REQUEST) Number of Responses (direction=RESPONSE) Sum(bytes)
Can someone please help me with this?
Thanks.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
05-06-2015
12:30 PM
Try this:
index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
martin_mueller
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
05-06-2015
12:30 PM
Try this:
index=ABC sourcetype=abc ServiceName=A* OR ServiceName=B* OR ServiceName=C* | eval raw_len=len(_raw) | eval count_{Direction} = 1 | timechart sum(count_REQUEST) as NumberOfRequests sum(count_RESPONSE) as NumberOfResponses sum(raw_len) as CombinedSize
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
edookati
Path Finder
05-06-2015
01:14 PM
great! it worked. Thanks a lot.
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)