Splunk Search

How to count a sequence of events to track the number of consecutive SUCCESSes and FAILUREs?

janoonan
Explorer

Hi:

I'm trying to count a sequence of events. Our events have a field status that can be either 'SUCCESS' or 'FAILURE'.

I would like to be able to track the number of consecutive successes, and failures.

So, if we go SSSSFFFSSSSF, that's 123400012340, or 0000123400001. The motivation is to show how long it takes us to change a Failure into Success.

I have the following, but the numbers don't grow.

| sort _time  
| fillnull a_last_value
| eval a_success_flag=if(status="SUCCESS", 1, 0) 
| streamstats last(a_last_value) AS a_tmp_last
| eval a_last_value=(a_tmp_last+a_success_flag)*a_success_flag

( a_tmp_last is always 0, a_success_flag 1 or 0 (that's good) and a_last_value is also 0 or 1)

Thanks

0 Karma
1 Solution

janoonan
Explorer

I was able to find an answer. Thanks all for you help.

This provides a chart which shows me how many consecutive fails occur each day (well, timechart span, but day by default).
search
| sort _time

| streamstats count as a_seq_num

| search status=SUCCESS

| delta a_seq_num AS a_not_successful_builds

| eval answer=a_not_successful_builds-1
| timechart max(a_not_successful_builds)

So, first, let's ensure that everything has a sequence number.
Next, get rid of the failures with the next search.
Now, find the difference between two sequence numbers.

So, let's say we have: S,S,SF,F,F,S,S,S
Then, we have seq_num, 1,2,3,4,5,6,7,8,9
Now, remove the F's : 1,2,3,7,8,9
Now, delta: 1,1,1,4,1,1
Subtract 1: 0,0,0,4,0,0

After that, it's formatting.

I'm happy. I am interested in other solutions. The search at the start means that I cannot combine results with a BY
e.g. -
| timechart max(a_not_successful_builds) by filter_term
does not work, because the seq_nums are not right....though, I could sort by two criteria. 🙂

View solution in original post

janoonan
Explorer

I was able to find an answer. Thanks all for you help.

This provides a chart which shows me how many consecutive fails occur each day (well, timechart span, but day by default).
search
| sort _time

| streamstats count as a_seq_num

| search status=SUCCESS

| delta a_seq_num AS a_not_successful_builds

| eval answer=a_not_successful_builds-1
| timechart max(a_not_successful_builds)

So, first, let's ensure that everything has a sequence number.
Next, get rid of the failures with the next search.
Now, find the difference between two sequence numbers.

So, let's say we have: S,S,SF,F,F,S,S,S
Then, we have seq_num, 1,2,3,4,5,6,7,8,9
Now, remove the F's : 1,2,3,7,8,9
Now, delta: 1,1,1,4,1,1
Subtract 1: 0,0,0,4,0,0

After that, it's formatting.

I'm happy. I am interested in other solutions. The search at the start means that I cannot combine results with a BY
e.g. -
| timechart max(a_not_successful_builds) by filter_term
does not work, because the seq_nums are not right....though, I could sort by two criteria. 🙂

stephane_cyrill
Builder

Hi ,

I think this can help you:

your_search | eval increment_success = 1 + [ search your_search|eval a_success_flag=if(status="SUCCESS", 1, 0) |return $a_success_flag] |eval increment_success =0 +  [ search your_search|eval a_faillure_flag=if(status!="SUCCESS", 0, 0) |return $a_faillure_flag] |table increment_success  _time

Note that you getthe true result of increment _success by removing 1

0 Karma

janoonan
Explorer

I tried both of these, but neither were successful.

I've used a transaction to produce a better result:
| transaction status maxpause=90m | search status=FAILURE

and now eventcount seems to give me the number of fails in a row..

Except that the maxpause is not exactly right. The events can occur many hours apart - though are normally one hour apart.

Ideally, I'd prefer to say 'startswith=FAILURE' and endswith=SUCCESS, though this hasn't worked yet. When I try it, I get two transactions, one with all of the successes, the other with the failures.

0 Karma

chimell
Motivator

Hi jannonan
I think that this search request will help you

......... |foreach status  [eval sta=if(status=="SUCCESS",1,0)]|streamstats sum(sta) as val|eval tu=if(status=="FAILURE",0,met)|table status  tu

Just test it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...