We have our dnsdebuglog turned on and I want to create a summary search of # of events in descending order. Results would look like this:
server 1 700,000
server 2 600,000
server 3 444,000
etc
Currently, we run a scheduled search every 24 hours (at midnight), but I would like to replace that with the summary search.
My attempts so far to make this work have resulted in there being approximately half as many events in the summary search as the scheduled search. Here is what I have:
Scheduled search (we only have 75 servers this applies to):
index="dns" sourcetype="dnsdebuglog" | top host limit=500
Summary search (run hourly):
index=dns sourcetype=dnsdebuglog | sistats count by host
Scheduled summary search:
index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count
What am I doing wrong?
I don't really see anything wrong with your seach try adding _time to sistats. Also try using the bucket command, it will allow you create a more accurate hour based summary. Try adding the follwing in your Summary search.
Summary search (run hourly):
index=dns sourcetype=dnsdebuglog | bucket span=1h _time| sistats count by _time, host
Scheduled summary search(I assume summary_dnsdebuglog is the name of your saved search):
index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count