Splunk Search

How to write a search to find which tablets have a latest status of Error or Corrupted?

tenyang
New Member

Hi all,

I have an event sent with the information if a tablet downloaded app successfully or not. If it faces problem, the label shows (AppCorrupted OR Error), but some of them can automatically fix this issue. Fox example, for a tablet called ABC, if AppCorrupted occurred at 11 AM, but it is up at 12 PM, then it would send a new event as event2 below label="AppDownloaded".

Currently my search can only count the total times "Error" or "AppCorrupted", but what I want is get the latest tablet name which is still down. In the previous example, tablet ABC should not be shown as it has been up already.

Please kindly guide me how to fix this problem, thanks in advance.

Event 1:

Jun 05 2015 10:35:47 action="AppDownloaded" category="TabletSystem" geoloc_city="Beijing" geoloc_country="China" label="Error" mount_description="WM-SM-F3" mount_id="651" mount_name="WuMart-Shi-Men F3 石门店 F3" mount_tags="" router_count="0" shop_id="f9ed04cf07c443258e53d25d97b6e285" shop_name="WuMart-Shi-Men" shop_tags="WuMart-Shi-Men, xwalk-library, Tablet-PIPO, With_PowerPoint, WuMart, WM-SM, Pilot-Apr2015, MassRebootTarget, Install_Grp7, Beijing, LIVE, District-Shun-Yi-Qu, ABTest-HnS-Exposed, Hypermarket, China" timezone_id="Asia/Shanghai" timezone_offset="28800000" value="22689566" 

Event 2:

Jun 05 2015 08:56:58 action="AppDownloaded" category="TabletSystem" geoloc_city="Singapore" geoloc_country="Singapore" label="AppDownloaded" mount_description="FP-BNA MountLocation-Dairy-Products" mount_id="779" mount_name="Fairprice Bedok North F2" mount_tags="MountLocation-Dairy-Products" router_count="0" shop_description="Blk 212 Bedok Nth St 1 #01-147 (460212)" shop_id="a4bba643726a4b3992eaba42e6413c19" shop_name="Fairprice Bedok North (BNA)" shop_tags="Tablet-FUGU, Supermarket, Install_May2015, xwalk-library, Singapore, Fairprice-Bedok-North, Campaign-Shared, MassRebootTarget, LIVE, Fairprice" timezone_id="Asia/Singapore" timezone_offset="28800000" value="-7750" 

My search:

LIVE category="TabletSystem" (AppCorrupted OR Error) |stats count by mount_name
Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

This will do it:

LIVE category="TabletSystem" (AppCorrupted OR Error OR AppDownloaded) |stats latest(label) by mount_name | where label != "AppDownloaded"

View solution in original post

0 Karma

woodcock
Esteemed Legend

This will do it:

LIVE category="TabletSystem" (AppCorrupted OR Error OR AppDownloaded) |stats latest(label) by mount_name | where label != "AppDownloaded"
0 Karma

tenyang
New Member

Thanks so much Woodcock, it is really helps.

Best Regards
Ten

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...