About edookati

edookati · ‎03-25-2018

I need help with framing a query which gives me the standard deviation of 5 values (for last business week) and compare the same with today's traffic for the same hour and trigger an alert if the difference is more than x% All i could get was the values for the same hour ever business day last week using simple chart command and I couldn't go past that. index=ABC sourcetype=DEF uri="/sample/event/test" earliest=-6d@w1 AND latest=-1d@w6 date_hour>5 date_hour<=18 | chart limit=100 span=1h dc(unique_id) over date_hour by date_mday Result date_hour 19 20 21 22 23 7 60366 61630 62768 62533 64369 I need data in this below format or at least the 3 values I am looking for StdDev(Last business week between 8 am - 9 am ET) Current_Hour's_Traffic DIfference_In_% 500 450 10 Thanks a lot.

edookati · ‎03-23-2017

Thanks a lot.

edookati · ‎05-06-2015

great! it worked. Thanks a lot.

edookati · ‎03-10-2015

Thanks a lot.

edookati · ‎12-29-2014

thanks. It worked fine.

edookati · ‎12-22-2014

Pretty close to my requirement and thanks a lot. This will do for now 🙂

edookati · ‎12-11-2014

thanks. it worked

edookati · ‎12-02-2014

Also, i would like to set limits on 90p value for individual services (there are about 60-70) and alert if the 90p value goes above the set limit or if the count above 90p is higher than set limit. Can you please suggest how this can be achieved. Thanks a lot.

edookati · ‎11-20-2014

thanks. It worked just great.

martin_mueller · ‎11-15-2014

Your URLs likely are stored in a multi-value field, so you can exploit that to filter: ... | where mvcount(URL) > 1 Alternatively, if you have to make sure two specific URLs are present, you can again use the multi-value property to filter like this: ... | search URL="/bankapi/session" URL="/bankapi/accounts" Note, that's using an implicit AND instead of OR... both will yield true for the transactions you want because the MV field contains both values.

edookati · ‎11-14-2014

Sorry, it is still giving me the same URLs in one transaction.

edookati · ‎08-12-2014

fantastic. It worked. Thanks.

somesoni2 · ‎07-30-2014

Try something like this index=a field1="ABC" | join id [Search index=a [Search index=a | stats count by field2 | return field2]] The innermost subsearch "[Search index=a | stats count by field2 | return field2]" will return 'OR' separate values to field2 to be used for subsearch.

lguinn2 · ‎07-28-2014

And BTW, @martin_mueller's technique will be MUCH faster...

martin_mueller · ‎07-22-2014

Isn't the eventstats obsolete in that search?

edookati · ‎07-28-2014

I can't put conditions on all fields.

Posts	33
Solutions	0
Karma Given	11
Karma Received	9
Member Since	‎07-22-2014

Online Status	Offline
Date Last Visited	‎08-14-2020 12:49 AM

standard deviation by hour for last business week ...

Transaction Maxpause doesn't work

get size/bytes of log events and the number events...

How to addcoltotals the percentage of StatusCodes ...

how to increment a value in eval function

how to draw a simple graph of response times again...

return events with null values in an eval function

How to search the 90th percentile value in a serie...

How to write a search to get a table of eventstats...

How to write a search to omit transactions unless ...

standard deviation by hour for last business week ...

Re: Transaction Maxpause doesn't work

Re: get size/bytes of log events and the number ev...

Re: How to addcoltotals the percentage of StatusCo...

Re: how to increment a value in eval function

Re: how to draw a simple graph of response times a...

Re: return events with null values in an eval func...

Re: How to search the 90th percentile value in a s...

Re: How to write a search to get a table of events...

Re: How to write a search to omit transactions unl...

Re: How to join 2 results and use transaction to d...

Re: format splunk table

Re: How to put field values in a table to call in ...

Re: How to join 2 searches and control table outpu...

Re: how to limit percent results to 2 decimal plac...

Re: How do I control returned fields from a join?

Are you a member of the Splunk Community?