Splunk Search

Sourcetype volume increase search

splunk_zen
Builder

I want to have an alert being raised when any of our top sourcetypes hourly indexing rises above a given monthly average ratio,
thus I'll be using a main and a sub search,
problem is, the searches are not working as expected,
I do get some gaps in the data like

2015-05-22 17.131487 35.147383 81.106295 40.277513 16.139312 13.474499 0.416715 67.234671
2015-05-23

2015-05-24

2015-05-25 5.011769 13.724414 14.070526 0.100698 5.972581 8.733943 0.059590 17.965508

thus the isnull clause but the totalGb field or sum(Gb) doesn't seem to be available downstream,
why and how can I make this work?

index=summary report=summarised_st earliest=-30d@d latest=@d
| where date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday"
| eval MonSourceType = sourcetype."MonthlyAvg"
| timechart limit=8 useother=f span=1d sum(GB) as totalGb by MonSourceType
| where NOT isnull(totalGb)
| stats avg(totalGb) by MonSourceType
0 Karma

woodcock
Esteemed Legend

First of all, you have a typo where MonSourceType will not match monSourceType. Also, you are creating totalGb but using sum(GB) which no longer exists. In any case, this is better:

 index=summary report=summarised_st earliest=-30d@d latest=@d | where date_wday="monday" OR date_wday="tuesday" OR date_wday="wednesday" OR date_wday="thursday" OR date_wday="friday" | eval MonSourceType = sourcetype."MonthlyAvg" | bucket _time span=1d | stats sum(GB) as DailyGbBySourcetype by MonSourceType | stats avg(DailyGbBySourcetype) AS AvgDailyGbBySourcetype by MonSourceType
0 Karma

splunk_zen
Builder

Yeah, those typos just came to be when I was masking the search to paste it publicly,
my initial search didn't suffer from those. Thanks

0 Karma

woodcock
Esteemed Legend

So did this work?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...