Hi all
I have hit a problem with Splunk which I am hoping someone might be able to offer some help with. I've just written a search which aims to collate IIS crashes to provide an overview of number of crashes versus hour of the day so i can see if there are any regular patterns.
The regex seems to work fine but i can't cluster on the fields extracted by the regex - i have previously done this successfully. Any ideas? My search is:
host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" |
rex field=_raw "(?<i_month>\d{1,2})\/(?<i_date>\d{1,2})\/(?<i_year>\d{2,4}) (?<i_hours>\d{1,2}):(?<i_minutes>\d{1,2}):(?<i_seconds>\d{1,2}).*" |
cluster field=i_hours t=0.99 countfield=numErrors
| sort -numErrors | table numErrors i_hours
Many thanks
Neil
I am not sure of the answer to your rex problem, but I do have a suggestion for the search -
You may not need the rex. Splunk automatically creates a number of fields from your timestamp: date_mday, date_wday, date_month, date_hour
So your search could be
host="*" earliest_time=-30d sourcetype="WinEventLog:Application" | search Message="Faulting application name: w3wp.exe*" |
cluster field=date_hour t=0.99 countfield=numErrors
| sort -numErrors | table numErrors i_hours