Splunk Search

How do I get my searches to run against the logs of each server, not across all servers?

cj039165
New Member

Hello

We are trying to use the search below to calculate response times. The search is looking for a thread ID in the 'United_Send.log" and its matching thread id in the 'United_Receive.log'. It then calculates the difference in the two time stamps associated with the thread ids. The application producing this log is running on 3 different servers. The problem, it's possible for the same thread ID to exist on all three servers. We are seeing odd results in the graph. I believe it’s because it's running the calculation against thread ID on different servers. How do I get the searches to run against each server, not across them?

Search Example:

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

Thanks

0 Karma
1 Solution

sundareshr
Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

View solution in original post

0 Karma

sundareshr
Legend

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)
0 Karma

cj039165
New Member

Thanks for the help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...