Splunk Search

How to get peakstats and a count of success and errors for a month in one table?

ashidhingra
Path Finder

How to get peakstats and a count of success and errors for a month in one table?

Labels (6)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ashidhingra,

the search depends on the data you have.

So supponing that the field with the traffic to monitor i "bytes" and the field with access and failed is "action" and that you want thes monitoring for each host, you could try something like this, for a month:

<your_search>
| stats
   max(bytes) AS peak
   count(eval(action="success")) AS success
   count(eval(action="failed")) AS failed
   BY host

 Ciao.

Giuseppe

0 Karma

ashidhingra
Path Finder

I am getting the peak stats by bucket using this 

<your_search>
| bucket span=1s _time 
| stats count by _time 
| timechart max(count) AS Peak_TPS span=1m

Some how the two Queries are not working together 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @ashidhingra,

yes, because after a stats command you have only the fields in the stats, you shuld try something like this:

<your_search> earliest=-1mon latest=@mon
| bucket span=1s _time 
| stats 
   count 
   count(eval(action="success")) AS success
   count(eval(action="failed")) AS failed
   BY _time 
| stats
   max(count) AS Peak_TPS 
   sum(success) AS success
   sum(failed) AS failed

You cannot use timechart because in timechart you cannot have more fields

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...