Splunk Dev

Different Ranges queries

TiagoMatos
Path Finder

Hello. I need to calculate statistics like Avg, Count, from the past two weeks period.

What I want to do next is to check if the same measure in the days AFTER those two weeks are above it or not.

I Can't figure out if it is a join, append or something else to write... Here is what I've got:


index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=8/25/2013:00:00:00 latest=-24h date_wday=friday date_hour=15
| eventstats perc25(executiontime) as Q1Tempo, perc75(executiontime) as Q3Tempo
| eval lim1=Q3Tempo+3*(Q3Tempo-Q1Tempo)
| eval lim2=Q3Tempo+6*(Q3Tempo-Q1Tempo)
| eval lim3=Q3Tempo+10*(Q3Tempo-Q1Tempo)
| eval Performance=case(executiontime>lim3,"High_Alert",executiontime>lim2,"Mid_Alert",executiontime>lim1,"Low_Alert",executiontime<lim1,"OK")
| eval Low=if(executiontime>lim1 AND executiontime<lim2,1,0)
| eval Mid=if(executiontime>lim2 AND executiontime<lim3,1,0)
| eval High=if(executiontime>lim3,1,0)
| eval OutQ=if(executiontime>lim1,1,0)
| stats avg(OutQ) as AvgOut,avg(Low) as AvgLow, avg(Mid) as AvgMid,avg(High) as AvgHigh

Now I want to get those Avg and see where executiontime in the period

index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=9/6/2013:00:00:00 latest=now date_wday=friday date_hour=15

is going. Can you help please?

Thank you

Tags (3)
0 Karma

TiagoMatos
Path Finder
index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=8/25/2013:00:00:00 latest=-24h date_wday=friday date_hour=15

| eventstats perc25(executiontime) as Q1Tempo, perc75(executiontime) as Q3Tempo 

| eval lim1=Q3Tempo+3*(Q3Tempo-Q1Tempo) 

| eval lim2=Q3Tempo+6*(Q3Tempo-Q1Tempo)

| eval lim3=Q3Tempo+10*(Q3Tempo-Q1Tempo) 

| eval     
Performance=case(executiontime>lim3,"High_Alert",executiontime>lim2,"Mid_Alert",executiontime>lim1,"Low_Alert",executiontime<lim1,"OK") 

| eval Low=if(executiontime>lim1 AND executiontime<lim2,1,0) 

| eval Mid=if(executiontime>lim2 AND executiontime<lim3,1,0) 

| eval High=if(executiontime>lim3,1,0) 

| eval OutQ=if(executiontime>lim1,1,0) 

| stats avg(OutQ) as AvgOut,avg(Low) as AvgLow, avg(Mid) as AvgMid,avg(High) as AvgHigh
0 Karma

Ayn
Legend

Format code blocks by blank lines before and after + 4 spaces at the start of each line, please.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...