Splunk Search

How to convert at InfluxDB SQL query to a Splunk SPL search?

registration9
New Member

We have a FIG (fluentD/InfluxDB/Grafana) setup in which we want to change the IG part to Splunk. We have several dashboards we need to convert. A picture of 1 of them is attached. The SQL query we use is:

SELECT mean(\"value\") FROM \"dev.agent\" WHERE (\"type\" = 'traffic-stats.rxpps' OR \"type\" = 'traffic-stats.txpps') AND \"device\" =~ /$host_regex/ AND \"interface\" =~ /$interface$/ AND $timeFilter GROUP BY \"device\", \"interface\", \"type\", time($GroupBy)"

What would the SPL look like? I have fluentD pushing the data into its only index in Splunk. The index is called "sandbox"

I assume the SPL query would start with

index="sandbox" AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps") AND (device=

That's as far as I have gotten. I need to dynamical select a device and interface. I have no clue how to code the "GROUP BY" SPL equivalent.

Thanks
alt text

0 Karma

indeed_2000
Motivator

@registration9 did you connect splunkdb with influxdb?

i try it but got error:

https://community.splunk.com/t5/Splunk-Search/driver-influxdb-to-splunk-db/m-p/605850#M210681

would please how do you do this?

 Thanks 

0 Karma

woodcock
Esteemed Legend

Like this:

index="sandbox" earliest=timeFilterMinValue latest=timeFilterMaxValue AND (type="traffic-stats.rxpps" OR type="traffic-stats.txpps")
| where match(device, "HostRegExHere") AND match(interface, "InterfaceRegExHere")
| eval dev_int_type = device . "/" . interface . "/". type
| timechart span=5m mean(value) BY dev_int_type 
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...