How do I get my searches to run against the logs of each server, not across all servers?

[cj039165]

Hello

We are trying to use the search below to calculate response times. The search is looking for a thread ID in the 'United_Send.log" and its matching thread id in the 'United_Receive.log'. It then calculates the difference in the two time stamps associated with the thread ids. The application producing this log is running on 3 different servers. The problem, it's possible for the same thread ID to exist on all three servers. We are seeing odd results in the graph. I believe it’s because it's running the calculation against thread ID on different servers. How do I get the searches to run against each server, not across them?

Search Example:

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

Thanks

[sundareshr · Accepted solution]

You should add host to your group by clause. Like this

index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time)

[cj039165]

Thanks for the help.