Splunk Search

How to merge two diff queries, but display only if the patching has happened?

haripotu
Loves-to-Learn Everything

Index = prod-x7 host IN ( 12345678) sourcetype=“Wineventlog” Eventcode=“19”

|eval patching = if(eventcode =“19”, “ok”, “not ok”)

If events are found then search server availability i.e.,

index= server_123 host in (12345678) uri_stem IN (http/hltchck)

| status count eval( status=100) as success, count as total by _time

|eval Percent = round((Success/total)*100,2)

| table Percent

 

how to merge this two diff querys. But display only if the patching has happened 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @haripotu,

at first, in  the first search, if you put the condition EventCode=19, the second row is useless because you have only ok events.

Then, if you want to use _time in a stats command, you have to group timestamps using the bin, command, e.g. for one hour.

so you can merge the two searches in this way:

index= server_123 host IN (12345678) uri_stem IN (http/hltchck) [ search index=prod-x7 host IN (12345678) sourcetype=“Wineventlog” Eventcode=“19” | fields host ]
| bin span=1h _time
| stats 
   count eval(status=100) AS success 
   count AS total 
   BY _time
|eval Percent=round((Success/total)*100,2)

Ciao.

Giuseppe

haripotu
Loves-to-Learn Everything

But i need the second percent search (percent  query) only if we find events for event code =19

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @haripotu,

if you want the percent of EventCode=19 over all the events, you could run something like this:

index= server_123 host IN (12345678) uri_stem IN (http/hltchck)fields host
| bin span=1h _time
| stats 
   count(eval(status=100) AS success 
   count AS total 
   BY _time host
| search [ search index=prod-x7 host IN (12345678) sourcetype=“Wineventlog” Eventcode=“19” | fields host ]
| stats 
   sum(count) AS Success 
   values(total) AS total
   BY _time
| eval Percent=round((Success/total)*100,2)

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...