About shashank_24

Lavender · ‎08-27-2023

What will be the solution if we are trying to join two savedsearches . How could we avoid the truncate issue . I am trying to join two saved searches , but I cant able to combine two saved searches without join command . Could you please help query is : |loadjob savedsearch="admin:command_center:datamodel_search" |search status!=Resolved AND status!=closed AND status!=cancelled |join type=left inc_id [|loadjob savedsearch ="admin:command_center:sev_datamodel_search" |search sla_status="Completed" AND sla_type="Hold" AND flag=1 |stats sum(sla_time) as sla_complete by inc_id]

tywhite · ‎02-22-2023

We're using Opsgenie with Splunk https://splunkbase.splunk.com/app/3759 Splunk Enterprise Version:8.2.9 Installed the app and then added the API (from the Splunk integration in Opsgenie) in the Set up. Have you reviewed the Opsgenie logs to confirm whether or not the alert was received from Splunk? It may have been received, but failed to create an alert for some other reason.

ITWhisperer · ‎11-04-2022

You could try something like this | rex max_match=0 "(?ms)<(\w+:)?productIdentifier>(?<productIdentifier>[^<]+)</(\w+:)?productIdentifier>.*?<(\w+:)?name>(?<productName>[^<]+)</(\w+:)?name>" | eval idName=mvzip(productIdentifier,productName) | stats count by idName | eval productIdentifier=mvindex(split(idName,","),0) | eval productName=mvindex(split(idName,","),1)

richgalloway · ‎09-22-2022

What do you mean by "a distorted graph"? Try removing the the table command as it is dropping a field that may be needed for the graph..

ITWhisperer · ‎09-06-2022

There is a timewrap command for this sort of thing.

gcusello · ‎05-13-2022

Hi @shashank_24, you approach is correct: you could create two alerts: one every 5 minutes, one every 30 minutes, obviously the threshold must be different otherwise the second one isn't useful. Ciao. Giuseppe

bowesmana · ‎05-10-2022

Take a look at the ML toolkit - there are some good examples on outliers there - you can also roll your own, e.g. this type of search will look for hourly outliers outside 3 * stdev search error | bin _time span=1m | stats count by _time | streamstats window=60 avg(count) as avg stdev(count) as stdev | eval multiplier = 3 | eval lower_bound = avg - (stdev * multiplier) | eval upper_bound = avg + (stdev * multiplier) | eval outlier = if(count < lower_bound OR count > upper_bound, 1, 0) | table _time count lower_bound upper_bound outlier Results Example

shashank_24 · ‎04-20-2022

Hi, I have a requirement where I want to create an alert on some of my APIs which are being monitored in Splunk. I've created a search which checks the success/failures of each API and then calculates the failure rate and if that is more than 10% then it triggers the alert. Now what is happening is the alerts gets triggered even for bigger blips when they are only for short duration. Like there is a high increase in error rate for 5 mins and then it gets recovered itself. I don't want to trigger the alert in that situation because it will make unnecessary callouts to people for investigation which is not required. How can i create alert which runs every 30 mins and looks into the failure rate consistently for each 5 mins in the last 30 minutes period. So if the failure rate is consistent for more than 15/20 mins then only trigger the alert. This is my base search index=api_prod (message.httpResponseCode=50* OR message.httpResponseCode=20*) | rename message.serviceName as serviceName message.httpResponseCode as httpResponseCode | stats count as totalrequests count(eval(like(httpResponseCode, "20%"))) as successrequest count(eval(like(httpResponseCode, "50%"))) as failedrequest by serviceName | eval Total = successrequest + failedrequest | eval failureRatePercentage = round(((failedrequest/totalrequests) * 100),2) | where failureRatePercentage > 10 | fields - Total |table serviceName,totalrequests,successrequest,failedrequest,failureRatePercentage Any guidance is really appreciated. Best Regards, Shashank

PickleRick · ‎02-13-2022

There is a requirement in HTTP 1.1 RFC describing the User-Agent format https://datatracker.ietf.org/doc/html/rfc7231#section-5.5.3 A user agent SHOULD send a User-Agent field in each request unless specifically configured not to do so. User-Agent = product *( RWS ( product / comment ) ) The User-Agent field-value consists of one or more product identifiers, each followed by zero or more comments (Section 3.2 of [RFC7230]), which together identify the user agent software and its significant subproducts. By convention, the product identifiers are listed in decreasing order of their significance for identifying the user agent software. Theoretically, a "product" and "version" here should be a "token", which means it should NOT include whitespace. And "comment" is any string contained within parentheses. You have to remember though that it's "just" an RFC and User-Agent is a user-side supplied value so you can have anything in there but you might probably classify all those outliers as "other".

impurush · ‎02-07-2022

Hi @shashank_24, Yes, the time chart will fail because when you use BY in the time chart which has multiple columns, then the result will have a column along with the API service name. I tried something like this and you can try like below (Instead of time chart, you can bucket command which will help in that case) index=myapp_prod source=myapp "message.logPoint"=OUTGOING_RESPONSE (message.httpResponseCode=50* OR message.httpResponseCode=20*) | rename message.serviceName as serviceName message.httpResponseCode as httpResponseCode | bucket span=5m _time | stats count as totalrequests count(eval(httpResponseCode=200)) as successrequest count(eval(httpResponseCode=500 OR httpResponseCode=502 OR httpResponseCode=503)) as failedrequest BY _time,serviceName | eval failureRatePercentage = round(((failedrequest/totalrequests) * 100),2) | where failureRatePercentage > 10 AND failedrequest > 200 | eventstats count by serviceName | where count>4 | field - count

richgalloway · ‎12-07-2021

You have the general idea, however like is a function (used the same way as match) rather than an operator. | eval device = case((like(useragent, "%Mobile%") OR like(useragent, "%Mobile%Safari%") OR like(useragent, "%iPhone%") OR like(useragent, "Android%Firefox%") OR like(useragent, "%UCBrowser%") OR like(useragent, "%IEMobile%") OR like(useragent, "%Dalvik%Android%") OR like(useragent, "%Android-STV100%") ), "Mobile Device", like(useragent, "%Windows NT%"), "Windows", like(useragent, "%Macintosh%"), "Macintosh", (like(useragent, "%Ubuntu%Linux%") OR like(useragent, "%X11%OpenVAS%")), "Linux", true() ,"others")

shashank_24 · ‎12-01-2021

This works like a charm. Thanks

kamlesh_vaghela · ‎07-27-2021

@shashank_24 If you observe the search I'm overwrite the _time by doing eval. It isn't working? _time=timeFrameStart

manjunathmeti · ‎04-20-2021

I didn't see you are using appendcols. You need to use append. index=myapp_prod sourcetype=myapp_service_log "System Exception" NOT "responseStatus=SUCCESS" NOT "ResponseStatusCode=404" NOT "Business Exception" | stats count as Failures by serviceName | append [ search index=myapp_prod sourcetype=myapp_service_log "responseStatus=SUCCESS" | stats count as Success by serviceName] | stats max(*) as * by serviceName | fillnull | eval Total = Success + Failures, FailureRatePercentage=(Failures*100)/Total

manjunathmeti · ‎03-16-2021

Try this: index=test apiKey=XXXXX event_name=cable.signin.success AND (app_version="1.0.1" OR app_version="1.0.2") | stats values(app_version) as app_version by uid | eval app_version=mvjoin(app_version, ",") | stats count(eval(app_version="1.0.1")) as count1, count(eval(app_version="1.0.1,1.0.2")) as count2 | eval result=count1-count2

bowesmana · ‎03-09-2021

You will need to give an example of your own data so we can help translate that to your desired output but probably something like | stats count by requestId node | stats list(node) as nodes list(count) as count by requestId but that will depend somewhat on your data

richgalloway · ‎03-05-2021

Based on the new requirements, you just need the stats command from my answer. Do be careful of cases in field names, though.

bowesmana · ‎01-27-2021

@shashank_24 How to determine 'peak'? There are a number of ways to look at this, but you could do a timechart and look for the count per minute rather than the total over 30 minutes, e.g. index=myindex sourcetype=ssl_access_combined requested_content="/myapp*" NOT images status=50* | timechart span=1m count by status | where '500'>10 which will look at the number of 500s per minutes and only alert if there are more than 10 in a minute. Or you could look for outliers, but this would require a bit of tuning for your your data. index=myindex sourcetype=ssl_access_combined requested_content="/myapp*" NOT images status=500 | bin _time span=1m | stats count by _time | streamstats window=10 avg(count) as avg, stdev(count) as stdev | eval multiplier = 2 | eval lower_bound = avg - (stdev * multiplier) | eval upper_bound = avg + (stdev * multiplier) | eval lower_outlier = if(count < lower_bound, 1, 0) | eval upper_outlier = if(count > upper_bound, 1, 0) | where upper_outlier=1 so this looks for any rolling 10 minute window where the average is 2 standard deviations above the average per minute. Play with the window/multipliers on your historical data to find a number that works for your data. I left the lower_outlier calc in their as an example of picking up values outside the lower bounds also. Hope this helps.

shashank_24 · ‎01-27-2021

Perfect It worked like charm. Thanks @renjith_nair

to4kawa · ‎12-14-2020

index=myapp_prod sourcetype=ssl_access_combined Method=GET | reverse | streamstats count(eval(searchmatch("/products"))) as sessions by clientip | stats range(_time) as duration latest(requested_content) as latest_content by sessions clientip | where latest_content="/checkout/success"

ITWhisperer · ‎09-18-2020

@shashank_24 So a count by req_content by time would give you the counts index=test_prod sourcetype=access_combined_wcookie req_content=/checkout/your-details OR req_content=/checkout/direct-debit OR req_content=/checkout/credit-check OR req_content=/checkout/review-basket OR req_content=/checkout/confirm-order OR req_content=/checkout/order-complete | bin span=1h _time | stats count by req_content _time However, let's say a customer ends their journey between 8 and 9, but started it between 7 and 8, do you want the counts for the earlier steps to be included in the 7-8 slot (which is what the above will do), or do you want the counts in the 8-9 slot which the below attempts to do index=test_prod sourcetype=access_combined_wcookie req_content=/checkout/your-details OR req_content=/checkout/direct-debit OR req_content=/checkout/credit-check OR req_content=/checkout/review-basket OR req_content=/checkout/confirm-order OR req_content=/checkout/order-complete | stats values(req_content) as req_content, latest(_time) as _time by uniqueId | mvexpand req_content | bin span=1h _time | stats count by req_content, _time This doesn't take into account whether they went back and forth during their journey nor where they were when they ended their journey, it counts the pages visited not how many times in the journey it was visited. If you want the number of times the page was requested by the customer, try changing values(req_content) to list(req_content)

thambisetty · ‎09-18-2020

@shashank_24 yes, you are right.

shashank_24 · ‎09-08-2020

@thambisetty Thank you. after some modification to the query as per my need, I was able to get the relevant data. I will accept this answer. Thanks again.

richgalloway · ‎09-03-2020

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

shashank_24 · ‎08-11-2020

@niketn @to4kawa Thank you both for your help and response. I have tried using @niketn query and it satisfies my requirement. I am able to split the data by using clientID and it gives me the sum of success and failed login attempts by clientId. Thanks again both of you. You guys are stars 🙂

Posts	76
Solutions	0
Karma Given	17
Karma Received	0
Member Since	‎06-12-2020

Online Status	Offline
Date Last Visited	‎07-19-2023 07:51 AM

How extract data from SOAP request?

How to plot a graph with field having duplicate va...

How to create an alert on traffic drop Deviation?

How to create consistent monitoring and alerts bas...

How to create an alert that Detects anomalies or o...

How to create Alert trigger for only when there is...

How to extract using Browser Version from useragen...

Trigger Alert and avoid false p[positives

Extract browser type and device from User agent

Splunk integration with OpsGenie to send alert- Is...

Re: subsearch is truncating the results with join ...

Re: Splunk integration with OpsGenie

Re: Extract data from SOAP request

Re: How to plot a graph with field having duplicat...

Re: How to create an alert on traffic drop Deviati...

Re: Create Alert based on consistent results

Re: Detect anomalies or outliers in Splunk

How to create Alert trigger for only when there is...

Re: Browser Version from useragent

Re: Trigger Alert and avoid false p[positives

Re: Extract browser type and device from User agen...

Re: eval with wildcard

Re: Calculate hourly usage from Machine data

Re: Combine 2 searches to get Success and Failure ...

Re: Combine results of multiple queries and produc...

Re: How to count distinct values of a multi value ...

Re: Help with Stats command and total count of err...

Re: Splunk alert for peak errors only

Re: Calculate the average of 99th percentile

Re: calculate and plot the stats for various pages...

Re: Calculate the drop off rate during customer Jo...

Re: How to ignore or skip a particular timing in S...

Re: Peak hourly count between 2 events for success...

Re: Join 2 events with a unique ID

Re: How to produce stats with based on a field cli...