About splunek

splunek · ‎01-16-2014

Here was the final version that worked for me, for reference: query returning pts for each event earliest=-24h@h latest=@h | bin _time span=1h as hour | eval thisHour = if (hour <= relative_time(now(),"-1h@h"),1,0) | stats sum(pts) as sum_pts by hour sourcetype thisHour | stats max(sum_pts) as maxPts by sourcetype thisHour | eval pts = if(thisHour==0,maxPts,0) | eval maxPts = if(thisHour==1,maxPts,0) | stats sum(maxPts) as maxPts sum(pts) as PtsThisHour by sourcetype | where PtsThisHour >= (maxPts * 1.1)

splunek · ‎01-16-2014

Ok, there were just a couple of typos. One of the sourcetypes was spelled sourceType, and the maxPts and PtsThisHour were reversed, but other than that, works like a charm! Thank you so much!

splunek · ‎01-15-2014

Thanks, but I'm still having some trouble. I needed to put the "-1h@h" in quotes or it wouldn't evaluate, and also, it seems to break at step 4, at which point I get no results. I can't seem to fix it.

splunek · ‎01-15-2014

I've been trying to edit the original text of the question to make it clearer, but I can't get past the captcha...

splunek · ‎01-15-2014

That's not exactly what I'm looking for, as I'm actually looking for a specific log line that returns # of points processed per query, and that is the sum I am looking at, although I guess I can used index volume as a proxy for that, but that wouldn't be very exact.

splunek · ‎01-15-2014

Hi. I'm a splunk newbie and I am trying to construct a query over multiple sources that will do a sum of points over a day in 1 hr buckets and tell me whether in the past hour I have breached the max bucket size by a factor of 10%. I have tried to do this via a subsearch, which is very slow and I can't get it to quite work, or as one query, where I got the counts, but can't figure out how to get it to tell me whether it breached the max. Here is what I have so far: query returning pts for each event| bin _time span=1h as hour | stats sum(pts) as sum_pts by hour sourcetype Any help at all would be greatly appreciated!

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-15-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

check if current usage breached last highest value...

Re: check if current usage breached last highest v...

Re: check if current usage breached last highest v...

Re: check if current usage breached last highest v...

Re: check if current usage breached last highest v...

Re: check if current usage breached last highest v...

check if current usage breached last highest value...