Knowledge Management

Search optimization question

jonydupre
Path Finder

Hi all,

I had some trouble with a search but got it to work. But the search istelf isn't that "clean" I suppose.
Someone mentioned Timechart but I couldn't get it to work.

This is the search:

index=linux host="i*soe*" earliest=-1d@d latest=@d "healthcheck: System not healthy" | dedup host | stats count by host
| stats count as TotalA
| appendcols 
[search index=linux host="i*soe*" earliest=@d latest=now "healthcheck: System not healthy" | dedup host | stats count by host 
| stats count as TotalB]
| appendcols 
[search index=linux earliest=-2d@d host="i*soe*" latest=-1d@d "healthcheck: System not healthy" | dedup host | stats count by host 
| stats count as TotalC]
| eval Gister=TotalA 
| eval Vandaag=TotalB
| eval Eergisteren=TotalC
| fields HealthchecksError, 2days ago, Yesterday, Today

Would there be a way to improve the search syntax wise?
Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jonydupre,
your search isn't so clear, can you better describe what you want to have as result?
The total count of different hosts for each day?
eventually divided by HealthchecksError?

Anyway, reading you search I see that you don't need the first stats count (| stats count BY host ) because you have a dedup before and another stats count after.

Then I see that you used appendcols with the same search in a different period, while you could use timechart command, something like this:

 index=linux host="i*soe*" earliest=-2d@d latest=now "healthcheck: System not healthy" 
| timechart span=1d dc(host) AS n_hosts

If you want also differentiate the count of different hosts by HealthchecksError, you can add this clause to the timechart:

 index=linux host="i*soe*" earliest=-2d@d latest=now "healthcheck: System not healthy" 
| timechart span=1d dc(host) AS n_hosts BY HealthchecksError

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...