Splunk Search

Capture the peak points in a table

chadman
Path Finder

I have a great search that someone here helped me with the other day. It will take all the peak numbers in a search and add them. This works great, but now I need to filter out numbers lower than 4. My current search looks like this and works.

| table _time, idle 
        | rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0) 
        | accum sno | eventstats max("Idle Time") as max by sno 
        | where 'Idle Time'=max | table _time "Idle Time" 
        | stats sum("Idle Time") as "Idle Time" 

So if my numbers look like:

0,1,2,3,0,0,1,2,3,4,5,0,1,2,3,4,5

I would get a total of 13 because it adds the peaks of 3+5+5. User don't want to see peaks under 4. I thought I could just add a |where idle < 4 at the beginning of the search, but that does not give the correct number. In my example I would expect to see 10 because 3 would be thrown out.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

| table _time, idle 
         | rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0) 
         | accum sno | eventstats max("Idle Time") as max by sno 
         | where 'Idle Time'=max  AND 'Idle Time'>4| table _time "Idle Time" 
         | stats sum("Idle Time") as "Idle Time" 

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

| table _time, idle 
         | rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0) 
         | accum sno | eventstats max("Idle Time") as max by sno 
         | where 'Idle Time'=max  AND 'Idle Time'>4| table _time "Idle Time" 
         | stats sum("Idle Time") as "Idle Time" 
0 Karma

chadman
Path Finder

Thanks that did it!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You could add a where > 4 which will exclude anything less than 4

| table _time, idle 
         | rename idle as "Idle Time" | eval sno=if('Idle Time'=0,1,0) 
         | accum sno | eventstats max("Idle Time") as max by sno 
         | where 'Idle Time'=max | table _time "Idle Time" 
         | stats sum("Idle Time") as "Idle Time"  | where idle > 4
0 Karma

chadman
Path Finder

I thought the same thing and tried that as I mentioned above, but used it at the beginning of the search. Somehow that messes up the part that calculates the peaks. When you do that it will show the total of the highest peak instead of adding all the peaks like I need it to do.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...