Splunk Search

combining delta/where searches

tedder
Communicator

These searches: index=foo | delta a as a_delta | where a_delta < 0 index=foo | delta b as b_delta | where b_delta < 0 index=foo | delta c as c_delta | where c_delta < 0 index=foo | delta d as d_delta | where d_delta < 0

I'm combining them like the following:

index=foo | delta a as a_delta | delta b as b_delta | delta c as c_delta | delta d as d_delta | where a_delta < 0 OR b_delta < 0 OR c_delta < 0 OR d_delta < 0

Is there an easier way to do this?

Note a,b,c,d have different values; they can't and shouldn't be compared against each other.

As a bonus, it would be nice to identify which of the fields doesn't match. My combination only shows that they don't match, not that it is field "c" that is the culprit.

0 Karma

lguinn2
Legend

I assume that you want to trigger an alert if you get a negative delta for any of the fields. But I'm not clear on why you need to combine the searches.

If the search is slow because there is a lot of data, I suggest that you run it more often. For example, if it is running every hour, run it every 15 minutes instead. Also, is there any way that you could further restrict this search, instead of just searching index=foo? Do the fields a, b, c and d appear in every event in the foo index?

If you run 4 searches instead of a single search, you will be able to set your alert text to easily see which field has gone wacky.

Please correct me if I don't understand the issue,

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...