Hello,
The following search:
index=app_win source=service State=Stopped StartMode (Auto OR Manual) Name=*IBM* OR Description=*IBM* OR DisplayName=*IBM* | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name"
does not show some events.
Here is an example of one that shows up just fine:
Type=Service
Name="IBMWAS70Service - TOS_Server_Server01"
DisplayName="IBM WebSphere Application Server V7.0 - TOS_Server_Server01"
Description="Controls the running of an IBM WebSphere Application Server V7.0 server named: TOS_Server_Server01"
Path=""C:\vol\data\IBM\WebSphere\AppServer-V70\bin\wasservice.exe" "IBMWAS70Service - TOS_Server_Server01""
ServiceType="Own Process"
StartMode="Manual"
Started=false
State="Stopped"
Status="OK"
ProcessId=0
host = server01
source = service
sourcetype = WinHostMon
Here is an example of one that does NOT show up in the | stats output:
Type=Service
Name="MailService"
DisplayName="IBM Rational ClearQuest Mail Service"
Description=
Path=""C:\Program Files (x86)\IBM\RationalSDLC\ClearQuest\mailservice.exe""
ServiceType="Own Process"
StartMode="Auto"
Started=false
State="Stopped"
Status="OK"
ProcessId=0
host = server02
source = service
sourcetype = WinHostMon
Any ideas?
Perhaps something to do with the description being blank? Why would that matter (especially when using an OR operator)?
Thanks!
I found the answer (Thanks to Splunk Support staff):
When the stats is used for multiple column, it will only consider the rows that values for all of the fields listed in "by" part of stats
To pull all rows you need to use fillnull option as covered in http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Fillnull
All you need to do with add
| fillnull value=NULL
I found the answer (Thanks to Splunk Support staff):
When the stats is used for multiple column, it will only consider the rows that values for all of the fields listed in "by" part of stats
To pull all rows you need to use fillnull option as covered in http://docs.splunk.com/Documentation/Splunk/4.3.3/SearchReference/Fillnull
All you need to do with add
| fillnull value=NULL
index=app_win source=service State=Stopped StartMode (Auto OR Manual) (Name="*IBM*" OR Description="*IBM*" OR DisplayName="*IBM*") | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name"
Try with the or's bracketed.
Do you mean in parenthesis?
I tried your example and get the same results.
Any other ideas?
Thanks!