Splunk Search

How to write a query to have count of time where time is greater than 20s hits of one field "Time " against total time hits "Time" ,to create alert .

guru865
Path Finder

here is a search i'm using for one alert.

sourcetype=xx  source="*yy"   method=*  timeDiff|    eval Time=ltrim(rtrim(timeDiff,"S"),"PT") | stats count(Time) as Total_Hits | search Time>20

The above search fulfills the alert request to get the total hits where time is greater than 20 s.

I would like to have the count of total hits on whole and greater than 20 s hits and would like to trigger the alert .

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about this. This alert query will return result (so you can alert when 'number of events greater than zero') when there are events with Time>20.

sourcetype=xx  source="*yy"   method=*  timeDiff
| eval Time=ltrim(rtrim(timeDiff,"S"),"PT") 
| stats count as Total_Hits count(eval(Time>20)) as AlertField
| where AlertField>0
| rename AlertField as "Hits_With_Time>20"

View solution in original post

woodcock
Esteemed Legend

Like this:

sourcetype=xx  source="*yy"   method=*  timeDiff |  eval Time=ltrim(rtrim(timeDiff,"S"),"PT")
| stats count(eval(Time>20)) AS Time20Plus | search Time20Plus>20
0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this. This alert query will return result (so you can alert when 'number of events greater than zero') when there are events with Time>20.

sourcetype=xx  source="*yy"   method=*  timeDiff
| eval Time=ltrim(rtrim(timeDiff,"S"),"PT") 
| stats count as Total_Hits count(eval(Time>20)) as AlertField
| where AlertField>0
| rename AlertField as "Hits_With_Time>20"

guru865
Path Finder

Thanks alot somesoni2.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

At the very least, you need to test against the name of the field that you just created, because after the stats command, the field Time no longer exists.

 | stats count(Time) as Total_Hits | search Total_Hits>20

more likely, you want

| stats count(eval(Time>20)) as Hits20 count as HitsTotal

Here's some test code you can play with -

|makeresults | eval Time="20 45 1 4 13 25 71 819 12" | makemv Time |mvexpand Time 
| stats count(eval(Time>20)) as Hits20 count as HitsTotal
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...