Hello. Today, I have several panels in a dashboard to provide us daily, weekly, and monthly counts of certain problem areas. When it comes to one of the scripts though, I would like to only provide a count if the number is higher than 10. Below is one of the queries we currently have in place:
<panel>
<title>Today</title>
<table>
<title>Kickouts for CSC</title>
<search>
<query>host=hfs-p2-ma-a* source=*console.log "Pinging" | stats count as Total</query>
<earliest>@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">none</option>
<option name="rowNumbers">1</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">raw</option>
</table>
</panel>
Also, below are examples of the output in splunk today in order to gather those counts:
STATUS | wrapper | main | 2018/09/06 16:47:38.283 | Pinging the JVM took 11 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:38.283 | Pinging the JVM took 2 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:10.731 | Pinging the JVM took 11 seconds to respond.
STATUS | wrapper | main | 2018/09/06 16:47:10.731 | Pinging the JVM took 2 seconds to respond.
We know that a "kick out" takes place if the Pinging takes longer than 10 seconds today. Is there a way to rewrite the query to only count if the pinging takes longer than 10 seconds or is it something where we would have to rewrite the regular expression to read something like --> Pinging the JVM took [0-9][1-9] seconds to respond.
Any help would be greatly appreciated!
-Cameron
... View more