Splunk Search

Subtract input from output

indeed_2000
Motivator

Hi
I have some process that does not finish successfully, Now i want to trace them with splunk.

here is scenario:
I have wildfly that create log file. when I start wildfly this code WFLYSRV0025 appear in the log. now I want after latest time that whildfly started, splunk start to count number of "input" and "output" like below.

“Input” mean new processes start “need to store count of previous value then it always increasing ”(streamstats sum(count))
“output” means process has been finished “need to store count of previous value, this value subtract from input continuously ” (streamstats sum(count))

The goal is splunk tell me how much process still not finish. and show this on timechart.

 

here is the log:

2021-07-06 23:10:47,131 INFO [as] WFLYSRV0025: Wildfly EAP 7.0.0.GA
2021-07-06 23:11:12,197 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,187 INFO [app] output, User: anonymous
2021-07-06 23:11:12,178 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,167 INFO [app] output, User: anonymous
2021-07-06 23:11:12,159 INFO [app] input , time[10] User: anonymous
2021-07-06 23:11:12,149 INFO [app] output, User: anonymous
2021-07-06 23:11:12,141 INFO [app] input , time[10] User: anonymous


4 input, 3 output

In above log as you see 1 input still remain, and not finished

2021-07-06 23:30:47,131 INFO [as] WFLYSRV0025: Wildfly EAP 7.0.0.GA
2021-07-06 23:30:47,197 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,141 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,134 INFO [app] output, User: anonymous
2021-07-06 23:30:47,138 INFO [app] output, User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous
2021-07-06 23:30:47,131 INFO [app] input , time[10] User: anonymous

5 input, 2 output

In above log as you see 3 input still remain, and not finished

I want to show this on timechart, in each minute that show me how many input still there.

Any idea,
Thanks

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| eval wildfly=if(match(_raw,"WFLYSVR0025"),1,0)
| eval input=if(match(_raw,"input"),1,0)
| eval output=if(match(_raw,"output"),1,0)
| streamstats sum(wildfly) as wildfly
| streanstats sum(input) as input sum(output) as output by wildfly
| eval stillrunning=input-output

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| sort 0 _time
| eval wildfly=if(match(_raw,"WFLYSVR0025"),1,0)
| eval input=if(match(_raw,"input"),1,0)
| eval output=if(match(_raw,"output"),1,0)
| streamstats sum(wildfly) as wildfly
| streanstats sum(input) as input sum(output) as output by wildfly
| eval stillrunning=input-output
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...