Splunk Search

Stumped on basic stats to return a unique identifier from the slowest event by action

Cuyose
Builder

So the concept is ridiculously simple, however I am having a monumental brain fart.

I want to generate a table with 3 columns : method, maxduration, guid

I only want to have as many rows as there are unique methods, and return the guid of that event with the max duration returned.

example of what I want

get,23000,GUID4295690
put,2243,GUID211233
post,24321,GUID8986

However the number of unique methods can change based on my base search.

Tags (3)
0 Karma
1 Solution

tiagofbmm
Influencer

Hey

You can use dedup to dedup your http methods.

But i suspect that this is not the solely thing you want.

You want the max duration per http method. So I would go for

your search | stats max(duration) as max duration, values(GID) AS GUID by http_method

That would give you a table of of the guids .

If you just want the guid that has max duration, do yoursearch | eventstats max(duration) as max_duration by http_method | where duration=max_duration | table max_duration, THIS, http_method

View solution in original post

Cuyose
Builder

Ugh, I was making it more complicated than it needed to be in my head.

| eventstats max(DurationMS) as maxduration by method
| where DurationMS=maxduration
|table maxduration method guid

0 Karma

tiagofbmm
Influencer

Please if the answer I gave you solved your issue, accept and upvote that answer

0 Karma

tiagofbmm
Influencer

Hey

You can use dedup to dedup your http methods.

But i suspect that this is not the solely thing you want.

You want the max duration per http method. So I would go for

your search | stats max(duration) as max duration, values(GID) AS GUID by http_method

That would give you a table of of the guids .

If you just want the guid that has max duration, do yoursearch | eventstats max(duration) as max_duration by http_method | where duration=max_duration | table max_duration, THIS, http_method

Cuyose
Builder

ha, i shoulda refreshed before I added my answer, thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...