Questions tagged [splunk-calculation]
93 questions
5
votes
1 answer
splunk check if message contains certain string
In Splunk search query how to check if log message has a text or not?
Log message:
message: 2018-09-21T07:15:28,458+0000 comp=hub-lora-ingestor-0 [vert.x-eventloop-thread-0] INFO com.nsc.iot.hono.receiver.HonoReceiver - Connected successfully,…
Pratap A.K
- 4,337
- 11
- 42
- 79
5
votes
2 answers
Splunk how to combine two queries and get one answer
I am very new to Splunk and basically been dropped in the deep end!! also very new to language so any help and tips on the below would be great.
The out come i am trying to get is to join the queries and get Username, ID and the amount of…
James
- 51
- 1
- 1
- 3
4
votes
1 answer
How to parse JSON metrics array in Splunk
I receive JSON from API in the following format:
[
{
"scId": "000DD2",
"sensorId": 2,
"metrics": [
{
"s": 5414,
"dateTime": "2018-02-02T13:03:30+01:00"
},
{
"s": 5526,
…
Max Zhylochkin
- 79
- 1
- 5
4
votes
1 answer
How To Calculate Exact 99.9th Percentile in Splunk
Does anyone know how to exactly calculate the 99.9th percentile in Splunk?
I have tried a variety of methods as below, such as exactperc (but this only takes integer percentiles) and perc (but this approximates the result heavily).
base | stats…
user1763328
- 301
- 2
- 3
- 11
3
votes
1 answer
Splunk monthly interval time chart
I'm trying to create a timechart at intervals of one moth however the below code produces the sum of the entire month, I want the value on the 1st of each month,please let me know any solutions to get value as on
2022-10-01 …
Ann
- 31
- 4
2
votes
1 answer
Splunk - Displaying addcoltotals into its own column
I have a report where I am working with event logs. I have created a table with fields that are extracted from the event logs.
This is my splunk query:
| stats count as Total_by_Requester values(*) as * by Requester_Id
| table Type_of_Call LOB…
ashu mallik
- 49
- 1
- 6
2
votes
1 answer
Query to extract data
Here is a snippet of the logs:
127.0.0.1 - - [01/Dec/2020:00:00:11 -0500] "GET / url:"api/orderLaptop for customer id 123"
127.0.0.1 - - [01/Nov/2020:00:00:24 -0500] "GET / url:"api/orderLaptop for customer id 124"
127.0.0.1 - -…
user3376592
- 191
- 1
- 13
2
votes
1 answer
Splunk Concurrency Calculation
I have some data from logs in Splunk where I need to determine what other requests were running concurrently at the time of any single event.
Using the following query, I was able to have it return a column for the number of requests that ran at the…
SBB
- 8,560
- 30
- 108
- 223
2
votes
1 answer
splunk regex issue
How can we write regex for below?
CEF:0|Incapsula|SIEMintegration|1|1|Normal|0| fileId=465000430130063349
Here I want to extract only 0 placed between || just before fileId.
supriya
- 21
- 1
- 6
2
votes
2 answers
how to calculate duration between two events Splunk
I need to find the duration between two events. I went over the solutions on splunk and Stack Overflow, but still can't get the calculation.
Both sentToSave and SaveDoc have the time stamp already formatted, which is why I used the case function. I…
Zara Z.
- 23
- 7
1
vote
1 answer
Is there a splunk query to sum all the column values based on same row field?
I have a existing splunk table as:
JobAction
Status
TimeTaken(ms)
Records
Host
Delete
SUCCESS
100
50
Host1
Delete
SUCCESS
120
200
Host1
Insert
SUCCESS
500
30
Host1
Insert
SUCCESS
120
25
Host1
I want to get the totaltime and…
AD27060
- 21
- 5
1
vote
2 answers
Splunk Query to find all the occurrences of a Boolean key value pair in logs over a period of time
Given below is a snippet of splunk event. My requirement is to find all the occurrences of "isOutstanding": true. Here the point to note is that one event may/may not have multiple occurrences. Need to find the total count from multiple events over…
remya thekkuvettil
- 778
- 1
- 7
- 22
1
vote
1 answer
Splunk percentage value for each category
I have 2 columns service and status. How do I calculate percentage availability for each service.
total count for that service -> ts
5xx status for that service -> er_s
availability = ((ts - er_s) / ts) * 100
I am able to get as a whole or…
theGamblerRises
- 686
- 1
- 11
- 27
1
vote
0 answers
Conditional statement on delta if there's a series of negative numbers
csv image here, last column is deltaSuppose there's monthly raindrop data by state, how would I pick out 3 or 4 month of continuous decrease in a row (if 0 or positive ignore the state)
output should be NY and HI only.
rows are as follows:
state …
Lexie
- 11
- 2
1
vote
1 answer
Splunk search by given timestamp not the time of ingestion to splunk
Is it possible to connect the timestamp given in the Data set to the Splunk date picker.
Enoy Lu
- 13
- 4