Splunk Search

eventtypes identification

rakesh_498115
Motivator

Hi

I have created 21 eventypes for my requirement.In tat 21 eventypes when i write a query only few eventtypes are involved . how do we indentify those eventtypes ?? and after identifying the eventtypes i need to print a table which shows the time duration taken for each eventype.

for Example assuse I have 21 eventtypes with names A,B,C,D...U .My requirement is i need to pass a searchparameter to a searchquery , which on excuting only involves few eventypes ..i need to indentify them and print the dimension duration spent for each eventype.assue A,B and D are the eventtypes involved for my searchquery with the given searchparameter value..

Now i need the table like this.

SearchParameter A B D

AAA 34 45 45

where A,B,D are the involved eventypes for the searchquery with searchparameter "AAA" and 34,45,45 are the duration time in secs spent at eventtype..Please reply asap.Thnx in advance..

Tags (2)
0 Karma

lguinn2
Legend

Here is a possible starting point, updated based on first comment:

yoursearchhere |
eval etype = case(eventtype=="eventtype1","eventtype1",eventtype="eventtype2","eventtype2") |
stats count by etype

This creates a new field called etype, which is set to one of the applicable eventtypes. This will work great, if you are only interested in a few of the eventtypes, and if the eventtypes do not overlap.

However, this does not calculate a "duration." You didn't give enough information for me to suggest how to do that.

I would suggest that you work this through with a particular search parameter, and when you are happy with the output - save the search as a macro. As a macro, you could do the parameter substitution that I think you ultimately want.

0 Karma

rakesh_498115
Motivator

i have used this . but then its displaying all the eventtypes .but i need only specfic eventtypes to display..ie the eventtypes which are involved for that particular search query

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...