Splunk Search

How do I get my searches to run against the logs of each server, not across all servers?

cj039165
New Member

Hello

We are trying to use the search below to calculate response times. The search is looking for a thread ID in the 'United_Send.log" and its matching thread id in the 'United_Receive.log'. It then calculates the difference in the two time stamps associated with the thread ids. The application producing this log is running on 3 different servers. The problem, it's possible for the same thread ID to exist on all three servers. We are seeing odd results in the graph. I believe it’s because it's running the calculation against thread ID on different servers. How do I get the searches to run against each server, not across them?

Search Example:

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

Thanks

0 Karma
1 Solution

sundareshr
Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

View solution in original post

0 Karma

sundareshr
Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)
0 Karma

cj039165
New Member

Thanks for the help.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...