Splunk Search

query explanation

DTERM
Contributor

Cab someone please explain what the following parts of the query do (just the bolded portion, not the entire query). Thanks.

The duration field that is being calculated looks like myapp_duration=0d 0h 0m 0s in the native format.

The whole search:

index=myapp NOT EIT_Net NOT businessUnit=EIT |
eval myapp_duration=replace(replace(replace(myapp_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(myapp_duration) 
| stats avg(myapp_duration) as avg_myapp_duration by severity 
| eval avg_myapp_duration=tostring(round(avg_myapp_duration,0),"duration")
| eval severity=case(severity==0,"Cleared", 
  severity==1,"Intermediate", 
  severity==2,"Warning",   
  severity==3,"Maintenance", 
  severity==4,"Major",
  severity==5,"Critical") 
| rename severity as Severity 
| rename avg_myapp_duration as "Average Duration"

Portion of interest:

eval myapp_duration=replace(replace(replace(myapp_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(myapp_duration) 
| stats avg(myapp_duration) as avg_myapp_duration by severity 
| eval avg_myapp_duration=tostring(round(avg_myapp_duration,0),"duration")
Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Well it takes the myapp_duration field, and replaces every occurrence of "ds" with "+", then from that output it removes every occurrence of the literal string "h|m|s".

Then still in the same expression it replaces every occurrence of the character "s" with ":".

Then this modified version of the myapp_duration field gets assigned back to overwrite the original value of myapp_duration in each result row.

Then it gets piped to the convert command which will turn that field from a human readable time string into a number of seconds.

Then it's all piped to the stats command, which will graph the average of myapp_duration for each unique value of severity, where each value of severity has its own row, and there's a column called "avg_myapp_duration".

Last but not least, another eval command will first round that value to an integer, then use the tostring function to turn it back into a string of the form "HH:MM:SS"

This page is the reference you want to use to look up all the little eval commands and arguments:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

View solution in original post

Drainy
Champion

@DTERM, you should really accept some answers - just to say thanks to the people that have helped you 🙂 (Click on the tick on the answer to accept it)

sideview
SplunkTrust
SplunkTrust

Well it takes the myapp_duration field, and replaces every occurrence of "ds" with "+", then from that output it removes every occurrence of the literal string "h|m|s".

Then still in the same expression it replaces every occurrence of the character "s" with ":".

Then this modified version of the myapp_duration field gets assigned back to overwrite the original value of myapp_duration in each result row.

Then it gets piped to the convert command which will turn that field from a human readable time string into a number of seconds.

Then it's all piped to the stats command, which will graph the average of myapp_duration for each unique value of severity, where each value of severity has its own row, and there's a column called "avg_myapp_duration".

Last but not least, another eval command will first round that value to an integer, then use the tostring function to turn it back into a string of the form "HH:MM:SS"

This page is the reference you want to use to look up all the little eval commands and arguments:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

View solution in original post

DTERM
Contributor

Wow, great explanation. May take a while to digest. Thanks much!

🙂

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!