Hi, I am working an setting up a alert where I need to count if there have been more than 50 count of errors in last 30 minutes. And if there is then I need to send the alert with those pages and count. Something like below requested_content Status Count /my-app/1.html 500 20 /my-app/2.html 500 40     60   Now the alert should only trigger if the sum of these counts > 50 like above. I have written a query but it only gives the count and not the pages which are throwing the error. I want to see the pages too index=myindex_prodsourcetype=ssl_access_combined requested_content="/my-app/*" status=50* | stats count by status | where count > 50 Can someone able to advice on this how to achieve this? I want the alert to be triggered and it should output the tabular format with pages and it's count with total count > 50 ... View more

Hi, I am working on a query where I need to calculate the average of 99th percentile values over a 5 minute period of time for last 24 hours by serviceName.  serviceName is nothing but the web service called by consumer and i am looking to have the response time of some services. Below is my query - index=myapp_prod sourcetype=service_log serviceName=service1 OR serviceName=service2 OR serviceName=service3 | eval responseTime= responseTime/1000000 | timechart span=5m p99(responseTime) as 99thPercentile by serviceName useother=false  which gives a table like this - _time service1 service2 service3 00:05 1.2 0.8 2.4 00:10 1.7 0.34 2.8 00:15 1.5 1.2 3.4   What i want is calculate the average of these and put it in another table. Something like this - serviceName responseTime service1 1.37 service2 0.4 service3 2.1   Hope someone can help. ... View more

Hi, I am stuck at a query problem. So what i need to do is join 2 events and get the hourly stats and peak hour successful login attempts. The sample events are -   2020-09-07 23:59:59,641 trackingid="id:638rdchdfe7vhs" event=AUTHN_ATTEMPT subject="" ip=8.2.8.44 app= clientId=WEB protocol="" role=IdP status=inprogress attributes="" description="" responsetime=39 messagetype="Request" 2020-09-07 23:59:59,641 trackingid="id:ljsdhff76duhj" event=AUTHN_ATTEMPT subject="" ip=8.2.8.24 app= clientId=MOBAPP protocol="" role=IdP status=inprogress attributes="" description="" responsetime=39 messagetype="Request" 2020-09-07 23:59:59,641 trackingid="id:8675hbcdksjdfub" event=AUTHN_ATTEMPT subject="" ip=8.6.8.24 app= clientId=SKYAPP protocol="" role=IdP status=inprogress attributes="" description="" responsetime=39 messagetype="Request"   as you can see the status right now is "inprogress" and different clientId's (WEB, MOBAPP, SKYAPP) and once customer logs in successfully the below event is logged.   2020-09-07 23:59:46,772 tid:638rdchdfe7vhs INFO [org.class.MediaCredentialValidator] in processPasswordCredential VERIFIED user=test@gmail.com found and success   I want to calculate the hourly volume of successful logins from clientId=WEB The common field in the events is id which i am extracting and what is want is a table with _time and count column on hourly basis. Query -   index=test (sourcetype=splunk_log event=AUTHN_ATTEMPT clientId=web status=inprogress) OR (source="server.log" "In processPasswordCredential" "found and success") | rex field=_raw "sessionid\=\"id\:(?<id>[^\"]+)" | stats count by tid     Let me know if someone can advice on this. @richgalloway @gcusello  ... View more