@links to members
'search earliest=-10m latest=now index= 'xyz'
(host=abcd123 or host=abcd345)
TxnStart2End| rex "Avg=(?<avgRspTime>\d+)" | rex "count=(?<count>\d+)" |timechart span=5m
sum(count) as Vol,
avg(avgrsptime) as "ART" | eval TPS=(vol/300) | table _time Vol Avgresptime TPS | sort_time'
the above query will fetch every 5 mins records so no worries but the issue is if the splunk job failed and run after half an hour for example:
suppose my job last run is 10:00am and it fetch records until 10:00 AM for every 5 mins spam.
my job got failed at 10:01 am and it will run again at 11:00 am, but in between 10:01 am to 11:00 am data is missing ( so my requirement is I need missing data in the spam of for every 5 mins)
i.e 10:05 data, 10:10 data ...10:50, 10:55 and 11:00 data..
please help with correct query.
How frequently your Splunk job runs (cron schedule)? What do you do with generated report?