Splunk Search

How to create a Splunk search for the following problem?

kc_prane
Path Finder

 My base search  PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 | eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | eval timeinsecs= round((TRAN_TIME_MS/1000),2) | stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY | eval sla= (countofpases/totalcount)*100 | table sla

 

I wanted to include all the PAGE_ID and the also use the criteria for the PAGE_ID=DGEFH  and  PAGE_ID =RGHJH

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The PAGE_ID field is not available to the table command because it was removed by the stats command.  The only fields available at to table are sla, PAGE_CATEGORY, totalcount, and countofpases.  You could make PAGE_ID available by including it in the stats command.

PAGE_ID=*
| where PAGE_ID=DGEFH  OR  PAGE_ID =RGHJH  NOT NUM_OF_MONTHS_RUN>=6 AND NOT
NUM_OF_INDIVIDUALS_ON_CASE>=4 
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| eval timeinsecs= round((TRAN_TIME_MS/1000),2) 
| stats count(eval(timeinsecs <=8)) AS countofpases count(timeinsecs) as totalcount by PAGE_CATEGORY, PAGE_ID 
| eval sla= (countofpases/totalcount)*100 
| table PAGEID sla

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kc_prane
Path Finder

Hi @richgalloway 

Thanks for the response but i was looking for the results which gets  PAGE_ID=* and  the subsearch 

"PAGE_ID=DGEFH OR PAGE_ID=RGHJH NOT NUM_OF_MONTHS>=6 AND NOT NUM_OF_INDIVIDUALS_ON_CASE>=4"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I explained why PAGE_ID are not in the results and offered one way to include it.

The original query already includes the specified search string (not a subsearch).  How is it not meeting expectations?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...