Splunk Search

Counting number of hits in a range

mehuman
New Member

Hi,
I'm trying to count the number of events where a value is over a certain amount as well as within a number of ranges.

Here is my search:

sourcetype=source | rex field=_raw "Java memory percentage: (?<java_mem_percent>.*), OS memory percentage: (?<os_mem_percent>.*)" | rex field=_raw "images was (?<launch_time>.*)" | stats count(eval(java_mem_percent>"90"))

Here is how the data is formatted:

Java memory percentage: 75, OS memory percentage: 64
Java memory percentage: 82, OS memory percentage: 75
Java memory percentage: 34, OS memory percentage: 32
Java memory percentage: 56, OS memory percentage: 79
Java memory percentage: 95, OS memory percentage: 67

Thanks!

Tags (1)
0 Karma

krugger
Communicator

I would say a where would filter out only the events when the memory percentage is above 90:

sourcetype=source | rex field=_raw "Java memory percentage: (?.*), OS memory percentage: (?.*)" | rex field=_raw "images was (?.*)" | where java_mem_percent > 90 | stats count

However what you might want is actually a rangemap:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rangemap

0 Karma

mehuman
New Member

Yes! Rangemap was exactly what I was looking for. Thanks!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Your stats count(eval(...)) approach is the correct one, where is it failing?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...