Splunk Search

creating a report that shows indexedtime vs logged time for each hour in percentage.

mrtolu6
Path Finder

I want to create a chart separated by hours (24hours) that shows the number of data that took more than 2 mins to be indexed (indextime-time) and converted into percent. The percent would be the total event that took over 2mins to be indexed divided by the total number of events for that hour.(for that 1 hour span)

This is the basic search I'm using to calculate the events over 2mins
index=nameoftheindex | eval time=_time | eval indextime=_indextime | eval diff=indextime-time | where diff>=120 | convert ctime(indextime) | convert ctime(time) fields sourcetype indextime time diff

Any help would be helpful. Thanks

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

You can't use a where clause that eliminates all the events under 2 minutes, and then later get a percentage of the total, because you don't have the total.

Here's one way...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

...or just ...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| timechart avg(GT2) as PercentGreaterThan2minutes 

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

You can't use a where clause that eliminates all the events under 2 minutes, and then later get a percentage of the total, because you don't have the total.

Here's one way...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time

...or just ...

earliest=-24h@h latest=@h index=nameoftheindex 
| eval GT2=if(_indextime-_time>=120,1,0)
| timechart avg(GT2) as PercentGreaterThan2minutes 

mrtolu6
Path Finder

Thanks DalJeanis that worked. How do I add "%" at the end of PctGT2 results and also move the decimal space to places to the right?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

earliest=-24h@h latest=@h index=nameoftheindex
| eval GT2=if(_indextime-_time>=120,1,0)
| bin _time span=1h
| stats avg(GT2) as PctGT2 by _time
|eval PctGT2 = round(PctGT2*100,2)."%"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...