Splunk Search

search query - categorizing results based on a field

New Member


Hi, bit new to splunk, looking for suggestions on one of my search queries:

Here's some sample events that I receive

{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 10000,
"connection.created" : 1603614820
}

{
"inbound.network.service": "192.168.1.20, 50700",
"inbound.bytes.count": 40000,
"connection.created" : 1603555900
}

{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 10200,
"connection.created" : 1603614820
}

{
"inbound.network.service": "192.168.1.20, 50700",
"inbound.bytes.count": 43000,
"connection.created" : 1603555900
}

{
"inbound.network.service": "192.168.1.7, 50990",
"inbound.bytes.count": 500,
"connection.created" : 1603679500
}

Details about individual fields:
- the "inbound.network.service" field has the endpoint for each connection in my server
- "inbound.bytes.count" will have the cummulative inbound bytes count for a particular inbound connection. This count gets resetted once the connection gets reset.
- "connection.created" has the timestamp when the connection got created. The timestamp value remains the same as long as the connection is valid. It gets resetted to a new timestamp once the connection is re-established. The "inbound.bytes.count" also gets re-initialized when that happens.

Here's my existing search query to list bytes received for a particular inbound network & service:

index=inettraffic source="my-server" inbound.network.service="192.168.1.7, 50990"
| reverse
| delta connection.created as connection_reset
| delta inbound.bytes.count as bytes_diff
| eval bytes_received = case(connection_reset == 0, bytes_diff, connection_reset > 0, 'inbound.bytes.count', true(), 0)
| table _time, inbound.network.service, connection.created, connection_reset, inbound.bytes.count, bytes_diff, bytes_received


Questions:
(1) Is there a better how this can be done ?
(2) I am looking to get a similar tabular listing of bytes received over _time for all inbound network & services that I have in my events so far. How do I do this ? With delta, it ends up taking a difference of the previous event which may not be for the same inbound.network.service.

Appreciate all your help here, thanks.

Labels (2)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!