Splunk Search

subsearch question

dpauls
New Member

Cannot get results from query using subsearch. I would like to compare the previous percentage of used space with the current percentage of used space. My subsearch looks at the current percentage of usage and should run first. That should be returning 51 (I'm converting the percentage into a numeric number in each query) which right now matches the previous percentage of space used so I am expecting results but getting none. There is only 1 result every 15 minutes.

earliest=-30m latest=-15m index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
| convert num(usedPercent) as pastPercent 
| SEARCH pastPercent=currentPercent 
   [ SEARCH earliest=-15m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
      |convert num(usedPercent) as currentPercent  
      | table currentPercent | return currentPercent ]

Any help would be appreciated!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this (should perform better than subsearch method)

earliest=-30m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
| eval period=if(_time>relative_time(now(),"-15m"),"current","past") 
| chart max(usedPercent) over index by period | where current=past

Just to explain, your subsearch syntax was wrong. You should be doing like this

earliest=-30m latest=-15m index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
 | convert num(usedPercent) as pastPercent 
 | where pastPercent=[ SEARCH earliest=-15m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
       |convert num(usedPercent) as query
       | table query ]

View solution in original post

0 Karma

lguinn2
Legend

Try this

 earliest=-30m@m latest=@m index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
 | convert num(usedPercent) as pastPercent 
 | eval TimeFrame=if(_time>relative_time(now(),"-15m@m"),"Current","Previous")
 | stats latest(usedPercent) as "Used Percent" by TimeFrame

What if there are multiple events within the 15 minute window? My search used the most recent event, but you could also choose the maximum or the average or...

Finally, your subsearch would only return a result if the current percent and the past percent were identical. This seems an odd criteria.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this (should perform better than subsearch method)

earliest=-30m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
| eval period=if(_time>relative_time(now(),"-15m"),"current","past") 
| chart max(usedPercent) over index by period | where current=past

Just to explain, your subsearch syntax was wrong. You should be doing like this

earliest=-30m latest=-15m index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
 | convert num(usedPercent) as pastPercent 
 | where pastPercent=[ SEARCH earliest=-15m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv" 
       |convert num(usedPercent) as query
       | table query ]
0 Karma

dpauls
New Member

Thank you so much, both worked. I was just using = during testing because I knew I should get a result off of that. In the future I will be actually validating that the space has not dropped by a certain percentage. I'll be able to add the calculation now that the query is working.

Again, thanks so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...