Splunk Search

help to write the stats query

dhavamanis
Builder

we have three column for the below query _time, response_time and count,

index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" | stats count by _time, response_time

now we want to count the results like this,

_time, (Sametime shouldnt repeat)
Max(response_time)
count - (should include all the events count)

Can you please help me to get this query.

Tags (2)
0 Karma
1 Solution

dhavamanis
Builder

Thanks musskopf, I have tried the below and its working fine for me,

index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" BRAND_ID="4b784d93d98941e087bbe75b1c2b9fbe" |stats count as cevent by _time, response_time | stats max(response_time) as mresponse, sum(cevent) as sevent by _time | sort by _time desc

View solution in original post

0 Karma

dhavamanis
Builder

Thanks musskopf, I have tried the below and its working fine for me,

index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" BRAND_ID="4b784d93d98941e087bbe75b1c2b9fbe" |stats count as cevent by _time, response_time | stats max(response_time) as mresponse, sum(cevent) as sevent by _time | sort by _time desc

0 Karma

musskopf
Builder

Hello dhavamanis,

Is that what you're looking for?

index="idxweblog" source="/opt/apache2/logs/idxapi.nbcuni.com-access_log" | eventstats count AS total_events | stats count, values(total_events), max(response_time) by _time

Just for you reference, the command eventstats is similar to stats, but instead of create a table, it'll add the result to each event as an additional field and you can use it on the next pipe.

Also, you might want to add something like | bucket span=10m _time after your search to group things together

If that's not what you're after, pls post an table showing how the result should looks like.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...