trying to list Heapdump and javacore counts across multiple hosts
Splunk search
host=A OR host=B OR host=C OR host=D "JVM requested Java dump" |stats count as Java_Dump by host | appendcols [search host=A OR host=B OR host=C OR host=D] "JVM requested Heap dump"|stats count as Heap_Dump by host
This one is not working for me ..Appreciate any suggestion to this
Also, I tried below one .. It return values for both Java dump and Heap dump but its giving wrong count and patterns
host=A OR host=B OR host=C OR host=D |stats count(eval(searchmatch("JVM requested Java dump"))) as Java_Dump count(eval(searchmatch("JVM requested Heap dump"))) as Heap_Dump by host
Your first search has syntax error (square bracket in wrong place). Correct search will be this
host=A OR host=B OR host=C OR host=D "JVM requested Java dump" |stats count as Java_Dump by host | appendcols [search host=A OR host=B OR host=C OR host=D "JVM requested Heap dump"|stats count as Heap_Dump by host]
This version has several issues, like running search on same data twice, subsearch limitations may apply, and if one of the host doesn't have that string, the column ordering would be wrong. A better approach would be like this
host=A OR host=B OR host=C OR host=D ( "JVM requested Java dump" OR "JVM requested Heap dump")
| eval Java_Dump=if(searchmatch( "JVM requested Java dump"),1,0)
| eval Heap_Dump=if(searchmatch( "JVM requested Heap dump"),1,0)
| stats sum(*_Dump) as *_Dump by host
Thank you very much. First query gives me now correct output. However .2nd one still
I am skeptiful in the extreme. The 2nd search is impeccable; it absolutely is correct. How are you determining otherwise?