About fredv44

fredv44 · ‎03-22-2022

Thanks @gcusello In fact the reason why I want to extract in a small range first is to narrow down my search (a sort of event sampling). There are millions of traceIds in this 2-hour range and search with traceId=* doesn't go through (timeout). I am looking to extract a subset of traceIds in this small range first so that I can look for all events that happened for those in this 2-hour range (hoping that Splunk will be able to efficiently use those traceIds to filter out millions of rows and not time out). Of course, a traceId can span over multiple minutes, hence a 5-minute range will be too short to capture what happened with those captured traceIds. I am intending to run this query at different dates/times in the past. I hope it makes sense 🙂

fredv44 · ‎03-22-2022

Hello. Given these logs: 2022-03-16 16:08:43.991 traceId="7890" svc="Service1" duration=132 2022-03-16 16:10:43.279 traceId="1234" svc="Service1" duration=132 2022-03-16 16:38:43.281 traceId="5678" svc="Service3" duration=219 2022-03-16 16:43:43.284 traceId="1234" svc="Service2" duration=320 2022-03-16 17:03:44.010 traceId="1234" svc="Service2" duration=1023 2022-03-16 17:04:44.299 traceId="5678" svc="Service3" duration=822 2022-03-16 17:19:44.579 traceId="5678" svc="Service2" duration=340 2022-03-16 17:32:44.928 traceId="1234" svc="Service1" duration=543 I would like in a single search to: extract all traceIds that happened between 17:00 and 17:05 search for the captured traceIds in larger range (say between 16:00 and 18:00) Is that possible? Thank you!

fredv44 · ‎03-20-2022

Thanks to @ITWhisperer and @BahadirS , it looks like the solution would be: index=... | stats min(_time) as txStartTs max(_time) as txEndTs avg(eval(if(svc="Service2",duration,null))) as avgDuration count(eval(svc="Service2")) as nbCallsService2 by traceId | where nbCallsService2>0 It works well with only one search, running stats on the bigger set of events, and building stats on Service2 by filtering out other services through: eval(if(svc="Service2",field,null)).

fredv44 · ‎03-20-2022

Thanks for the suggestion. Your query doesn't return what I am looking for though: average calculation is only for lines matching svc="Service2". Hence report should return 671.5 for traceId=1234, and not 574.25 as your query returns, which is the average of all events for this traceId, regardless of the service type.

fredv44 · ‎03-20-2022

Hi, From these logs (unique index): 2022-03-16 16:43:43.279 traceId="1234" svc="Service1" url="/customer/{customerGuid}" duration=132 2022-03-16 16:43:43.281 traceId="5678" svc="Service3" url="/customer/{customerGuid}" duration=219 2022-03-16 16:43:43.284 traceId="1234" svc="Service2" url="/user/{userGuid}" duration=320 2022-03-16 16:43:44.010 traceId="1234" svc="Service2" url="/shop/{userGuid}" duration=1023 2022-03-16 16:43:44.299 traceId="1234" svc="Service3" url="/shop/{userGuid}" duration=822 2022-03-16 16:43:44.579 traceId="5678" svc="Service2" url="/info/{userGuid}" duration=340 2022-03-16 16:43:44.928 traceId="9012" svc="Service1" url="/user/{userGuid}" duration=543 how to extract the following information? target only traceIds which trigger at least one operation to 'Service2' for each traceId, get first (txStart) and last (txEnd) event timestamps (including all logs for this traceId, not only those of Service2) build stats around 'Service2' Given the example above, I would like to get the following report: traceId txStartTs txEndTs nbCallsService2 avgDurationService2 1234 2022-03-16 16:43:43.279 2022-03-16 16:43:44.299 2 671.5 5678 2022-03-16 16:43:43.281 2022-03-16 16:43:44.579 1 340 Is it possible achieve this in one query? I tried to append, join searches but it does not go anywhere 😞 Ideally, I need something like like (in broken terms): index=idx | stats earliest(_time), latest(_time) by traceId | join traceId [ search index=idx svc="Service2" | stats count avg(duration) by traceId ]

Posts	6
Solutions	1
Karma Given	4
Karma Received	0
Member Since	‎03-19-2022

Online Status	Offline
Date Last Visited	‎03-25-2022 03:22 PM

How to extract list of event ids in shorter time r...

How to combine two searches from same index

Re: Extract list of event ids in shorter time rang...

How to extract list of event ids in shorter time r...

Re: Combine two searches from same index

Re: Combine two searches from same index

How to combine two searches from same index