index=source a1 OR a2 OR a3 OR a4 OR a5
how do I list the result them as
Application Count
a1 23
a2 54
a3 73
a4 52
a5 56
Total 258
I think it would be better to use a lookup table.
ex.)
applications.csv
application_id,application_name
a1,app1
a2,app2
a3,pp3
a4,pp4
a5,app5
index=source a1 OR a2 OR a3 OR a4 OR a5
|stats count by Application
|lookup applications.csv application_id as Application
|addcoltotals labelfield=Application_name label=Total count
|fields - Application
※Correct the field name correctly.
index=source 0oamhvpskG93fy30b297 OR amhpp7ohgExCpYDx51478
|stats count by Application
|lookup applications.csv application_id as Application
|addcoltotals labelfield=Application_name label=Total count
|fields - Application
Hello HiroshiSatoh,
My search above returns:
Error in 'lookup' command: Lookups: The lookup table 'applications.csv' does not exist or is not available.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
5.3k ● 5 ● 5 ● 9
5.3k ● 5 ● 5 ● 9
You should do your own lookup table creation and lookup definition.
http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Aboutlookupsandfieldactions
Hi HiroshiSatoh, it does not work
Try this!
index=source a1 OR a2 OR a3 OR a4 OR a5
|stats count by Application
|addcoltotals labelfield=Application label=Total count
a1,a2,a3,a4,a5 are the application id's. How do I name them as applications ?
a1 = app1
a2 = app2
a3 = app3
a4 = app4
a5 = app5
the output will be like this:
app1 23
app2 54
app3 73
app4 52
app5 56
Total 258
current search that i have below. This search only give me the total events , not categorize by application
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count | sort -_time
a1,a2,a3,a4,a5 are the application id's. How do name them as applications ?
can you share a sample of your data?
try this:
index=source a1 OR a2 OR a3 OR a4 OR a5 | timechart span=1d count by application
Hi Adorio, it does not work