Splunk Search

How to calculate the number of requests occurring per host from the search result

nramya82
Explorer

I am really new to splunk and can some one please help me I need to calculate number of request hitting our host so below is what written for every 15 minutes for one day in the log I am already using "Secure ABC" | search source = host which
filters and gives the below format but i need to calculate actual count (2345678-2340000) which is 5678 hitting 15 minutes like wise I have to find the count for whole day from the log. Any idea how to find difference

20140/09/28 06:45:00 Secure ABC : 2340000
20140/09/28 07:00:00 Secure ABC : 2345678
20140/09/28 07:15:00 Secure ABC : 2348900

Tags (1)
0 Karma

ulrich_track
Path Finder

I would:
1. Extract the hits as a field with the field extractor
2. use delta count(yourfieldname) AS diff

0 Karma

ulrich_track
Path Finder

Here is the regex for extracting the field with the Field Extractor (Hits):
(?i) ABC : (?P.+)

And here is the statement I put in the search field:
| table date_month date_mday date_hour date_minute Hits | delta Hits as tempdiff | eval Difference=tempdiff*(-1)

I am first creating a table to display the time and the extracted field, which I called "Hits". Then I calculated the difference using the delta command. To remove the negative prefix, I multiplied the field with -1.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...