Splunk Search

Can you validate an eval with an input?

AzySidhe
Explorer

I have a search that takes all enquiry and certain application response times and then counts them to display how many transactions are between 20 and 60 seconds and how many have exceeded 60 seconds. The problem that I'm facing is that I have an extraction on the Application field. This causes any applications connected to the enquiries to also be counted.

What I'm trying to do is use the list of applications from the lookup to eval JUST those applications. I tried it as a subsearch and appending the results together but it ran too slowly and would only return partial results as it would timeout.

PSEUDOSEARCH:

host=<hostname> source=<sourcename> [inputlookup Application.csv | fields Application | rename Application AS APPLICATION] OR REQUESTTYPE=Enq    uiry | stats count(eval((TIME_TOTAL >= 20000) AND (TIME_TOTAL < 60000) AND REQUESTTYPE=Enquiry)) As "ENQ - SLOW", count(eval(TIME_TOTAL >= 60000 AND REQUESTTYPE=Enquiry)) As "ENQ - TIMEOUT", count(eval((TIME_TOTAL >= 20000) AND (TIME_TOTAL < 60000) AND APPLICATION=<list of applications>)) As "APP - SLOW", count(eval(TIME_TOTAL >= 60000 AND APPLICATION=<list of applications>)) As "APP - TIMEOUT" | transpose | rename column As "Type", "row 1" As "count"

OUTPUT:
Type-----------------------------------count
ENQ - SLOW ------------------------130
ENQ - TIMEOUT--------------------25
APP - SLOW -------------------------80
APP - TIMEOUT---------------------6

Any help would be wonderful!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this. One ground work before this should, identity/add a field to Application.csv lookup table which is not present in the events. This is require to uniquely identify events which have APPLICATION present in the lookup Application.csv. I assume that field name is flag and flag has value "Y" for all rows in the lookup table.

 host=<hostname> source=<sourcename> [| inputlookup Application.csv | fields Application | rename Application AS APPLICATION] OR REQUESTTYPE=Enquiry | lookup Application.csv Application as APPLICATION OUTPUT flag | eval Type=case(TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND REQUESTTYPE=Enquiry, "ENQ - SLOW",TIME_TOTAL >= 60000 AND REQUESTTYPE=Enquiry, "ENQ - TIMEOUT",TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND flag="Y", "APP - SLOW" ,TIME_TOTAL >= 60000 AND flag="Y", "APP - TIMEOUT" ) | stats count by Type

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this. One ground work before this should, identity/add a field to Application.csv lookup table which is not present in the events. This is require to uniquely identify events which have APPLICATION present in the lookup Application.csv. I assume that field name is flag and flag has value "Y" for all rows in the lookup table.

 host=<hostname> source=<sourcename> [| inputlookup Application.csv | fields Application | rename Application AS APPLICATION] OR REQUESTTYPE=Enquiry | lookup Application.csv Application as APPLICATION OUTPUT flag | eval Type=case(TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND REQUESTTYPE=Enquiry, "ENQ - SLOW",TIME_TOTAL >= 60000 AND REQUESTTYPE=Enquiry, "ENQ - TIMEOUT",TIME_TOTAL >= 20000 AND TIME_TOTAL < 60000 AND flag="Y", "APP - SLOW" ,TIME_TOTAL >= 60000 AND flag="Y", "APP - TIMEOUT" ) | stats count by Type

AzySidhe
Explorer

This fixed the issue for me. Thank you so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...