Splunk Search

How can I turn my search into a visualization to track the rate/speed of endpoint agent upgrades?

umplebyj
Explorer

I have this search that I'm using streamstats with to show agents upgrading

source=client_data COMPUTER_NAME="*" AGENT_VERSION="*" 
| streamstats current=0 window=1 global=f last(AGENT_VERSION) as AgentVersion1 by COMPUTER_NAME 
| where AGENT_VERSION!=AgentVersion1

I'm trying to calculate out the rate that they are upgrading to get estimations for completion and overall reporting of progress.

Anyone have any suggestions on how I can turn this into a speed/progress meter?

0 Karma

sundareshr
Legend

How about this...

source=client_data COMPUTER_NAME="" AGENT_VERSION="" 
| streamstats current=0 window=1 global=f last(AGENT_VERSION) as AgentVersion1 by COMPUTER_NAME 
| timechart span=1h count(eval(AGENT_VERSION!=AgentVersion1)) as tbd count(eval(AGENT_VERSION=AgentVersion1)) as done by COMPUTER_NAME | eval rateofcompletion=3600/done | eval timetocomplete=tbd*rateofcompletion | eval timetocomplete=tostring(timetocomplete, "duration")
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...