如何 Splunk 搜索中位延迟超过 3 秒的交易类型答案

【问题标题】：How to Splunk search for transaction types that have a median latency above 3 seconds如何 Splunk 搜索中位延迟超过 3 秒的交易类型
【发布时间】：2020-05-11 21:52:09
【问题描述】：

我有一个显示延迟数据的表，现在我想编写一个警报查询，当请求（方法 + uri）的中位数高于 3000 毫秒（3 秒）时会发出警报

我用于该延迟表的查询是：

index=ms-app  environment=prod AND "*"
| eval uri=replace(mvindex(split('request.uri', "?"), 0), "\/\d+[-+\w]+", "/:n"), methodOverride='request.headers.X-HTTP-Method-Override'
| eval methodOverrideStr = if(isnull(methodOverride) OR methodOverride=="null", "", "(" + methodOverride + ")")
| eval request = 'request.method' + methodOverrideStr + " " + uri + " " + 'response.httpStatusCode'
| stats
min(stats.overallResponseTimeInMilliSeconds) as "Min",
avg(stats.overallResponseTimeInMilliSeconds) as avg_latency,
max(stats.overallResponseTimeInMilliSeconds) as "Max",
median(stats.overallResponseTimeInMilliSeconds) as "Median",
perc95(stats.overallResponseTimeInMilliSeconds) as "95th %",
count(request) as "# req total", count(eval('stats.overallResponseTimeInMilliSeconds' > 3000)) as "#>3s",
count(eval('stats.overallResponseTimeInMilliSeconds' > 5000)) as "#>5s",
count(eval('stats.overallResponseTimeInMilliSeconds' > 10000)) as "#>10s" by request
| eval "Avg" = round(avg_latency, 0)
| table request, "Median"

这会生成一个表格，显示基于方法 + uri 的延迟中值例如：

POST /first-endpoint 1000
GET /second-endpoint 2000
DELETE /第三端点 1500
POST /fourth-endpoint 4000
GET /fifth-endpoint 4500

现在我正在尝试创建一个查询，该查询将仅显示中值延迟高于 3 秒的方法 +uris，以便我可以创建警报，以提醒 splunk 哪些端点具有高延迟这是我尝试过的：

index=ms-app  environment=prod AND "*"
| eval uri=replace(mvindex(split('request.uri', "?"), 0), "\/\d+[-+\w]+", "/:n"), methodOverride='request.headers.X-HTTP-Method-Override'
| eval methodOverrideStr = if(isnull(methodOverride) OR methodOverride=="null", "", "(" + methodOverride + ")")
| eval request = 'request.method' + methodOverrideStr + " " + uri + " " + 'response.httpStatusCode'
| stats
median(stats.overallResponseTimeInMilliSeconds) as "Median"
| table request, "Median" > 3000

应该显示这个：

POST /fourth-endpoint 4000
GET /fifth-endpoint 4500

但是它只显示与第一个查询相同的结果

【问题讨论】：

如果你只需要| table 'Median' 和 'request' - 你不需要做所有这些额外的stats 步骤:)
是的，这些是用于较早的查询，忘记删除它们，谢谢 :)

标签： splunk latency splunk-query splunk-calculation splunk-formula

【解决方案1】：

使用where 命令根据字段值过滤事件。

... | where Median > 3000
| table request, Median

【讨论】：