Reporting

I need to find how many machines in a store have been offline more than 30 days over a 7 month time frame.

swatTC
New Member

There are more than 600+ store each having 50+ machines. The query i used is

storeNo="*" | table machineId,storeId,_time | sort 0 machineId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = tostring(_time - next_seq,"duration") | eval days=if(match(diff,"\+"),replace(diff,"(\d+)(\+.*)","\1"),0) 

It works fine with 1 or 2 stores. However the problem occurs when i run it across all stores. The final result tends to leave out some information/values from the final table. I suspect a memory issue but not sure.

I am a month old to Splunk and learning. Can you help me out here by suggesting any alternative method like iteration/looping or any methods where i can consume less memory.

0 Karma

somesoni2
Revered Legend

Give this a try

storeNo="*" | table machineId,storeId,_time | streamstats window=1 current=f global=f values(_time) as next_seq by machineId | eval diff = abs(_time - next_seq) | eval days=floor(diff/86400) 
0 Karma

swatTC
New Member

The above query is not working. Thank you anyways. My issue is , my posted query works fine with a single store but fails when i run it across all stores.

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Whats the logic to identify server is offline or online?

————————————
If this helps, give a like below.
0 Karma

swatTC
New Member

The timestamp between successive logs received for each machine in a store. I need to do a difference between these two time and find if it is greater than say 30 days, indicating the machine has been offline for that period.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...