Hi,
My queries is something like given below -
index=abc sourcetype=xyz ERROR | rename ERROR as "Error message" | timechart span=1h count by "Error message"
but it is not giving the exact result when its running. I want to see the column "error message" with the time frame but it's giving me the column "null" with the time frame. Any suggestions would be appreciated. Thanks
In the 2nd query -
index=abc sourcetype=xyz upload_log_message="ERROR*" | rename upload_log_message as "Error message" | top "Error message"
Through this query i want to see the top error messages that is showing in 1st query. this query is returning "no result found". How it could be possible when from 1st query i am able to fetching the error logs. Any ideas for this?
Thanks
Although you are selecting events with the string "error"
, you are not creating a field called ERROR
so splunk is using null
to indicate this. You need to use the rex
command (before the stats
command) to create this field and then it will work.