Splunk Search

eventtypes identification

rakesh_498115
Motivator

Hi

I have created 21 eventypes for my requirement.In tat 21 eventypes when i write a query only few eventtypes are involved . how do we indentify those eventtypes ?? and after identifying the eventtypes i need to print a table which shows the time duration taken for each eventype.

for Example assuse I have 21 eventtypes with names A,B,C,D...U .My requirement is i need to pass a searchparameter to a searchquery , which on excuting only involves few eventypes ..i need to indentify them and print the dimension duration spent for each eventype.assue A,B and D are the eventtypes involved for my searchquery with the given searchparameter value..

Now i need the table like this.

SearchParameter A B D

AAA 34 45 45

where A,B,D are the involved eventypes for the searchquery with searchparameter "AAA" and 34,45,45 are the duration time in secs spent at eventtype..Please reply asap.Thnx in advance..

Tags (2)
0 Karma

lguinn2
Legend

Here is a possible starting point, updated based on first comment:

yoursearchhere |
eval etype = case(eventtype=="eventtype1","eventtype1",eventtype="eventtype2","eventtype2") |
stats count by etype

This creates a new field called etype, which is set to one of the applicable eventtypes. This will work great, if you are only interested in a few of the eventtypes, and if the eventtypes do not overlap.

However, this does not calculate a "duration." You didn't give enough information for me to suggest how to do that.

I would suggest that you work this through with a particular search parameter, and when you are happy with the output - save the search as a macro. As a macro, you could do the parameter substitution that I think you ultimately want.

0 Karma

rakesh_498115
Motivator

i have used this . but then its displaying all the eventtypes .but i need only specfic eventtypes to display..ie the eventtypes which are involved for that particular search query

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...