Hi, my query returns exceptions thrown by every application. How do I filter this query to display only certain applications like Application="jobs"?
(index= OR index=_) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\+(?.*?).+monster" | timechart span=1h count by Application
You basically need to apply the filter based on Application
field. If the field Application
is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere"
in the base search. If The field Application
is not already extracted and you're extracting it via that rex
command in your search, you'll apply filter after the field is extracted.
Base search filter:
(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application
Filter after subsearch
(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application
You basically need to apply the filter based on Application
field. If the field Application
is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere"
in the base search. If The field Application
is not already extracted and you're extracting it via that rex
command in your search, you'll apply filter after the field is extracted.
Base search filter:
(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application
Filter after subsearch
(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application
@lsy9891,
Have you tried adding the condition to the base search ?
ie.
(index= OR index=_) ......... Application="jobs" earliest=-7d@d latest=@d
If there are multiple applications , you could try with OR
or IN
what all have you tried so far @lsy9891 ?