I am trying to get the stats for the search keywords. My query will list the errors by time but it wont tell me how many errors came for each search string. index=main source=*event* | search "NETWORK error" OR "OPS error" OR "NETSTAT ERROR" | bucket span=5m _time | stats count by _time ... View more

Is there any way to get the list of alerts created in Splunk last month or last week trended? ... View more

I have this query (thanks to somesoni2) which will scan the logs and say whether the sources has any log events or not. Existing Query index=saq source=* | rex field=source "(?:\\\\\\172.168.1.1\\\Logs\\\Production\\\*\\\(?<Application>.+?(?=\\\))|(?:\\\\\\\172.168.1.2\\\Logs\\\(?<Application1>.+?(?=\\\))))" | eval Apps = coalesce(Application, Application1) | stats count by Apps | append [| gentimes start=-1 | eval Apps="App1#App2#App3#App4...all app names here separated by #" | table Apps | makemv Apps delim="#" | mvexpand Apps | eval count=0 ] | stats sum(count) as count by Apps | eval hasevents= if (count>=1,"YES","NO") Output App count hasevents ---------------------------------------------------------- B2B 101 YES Silverlight 95 YES B2C 102 YES Ldoc 40 NO I want to run a sub search to get the errors count and wanted to add that errors count output to the main search output. So, I tried adding sub search to run similar query with error keywords for getting the errors count . Query tried using join, index=saq source=* | rex field=source "(?:\\\\\\172.168.1.1\\\Logs\\\Production\\\*\\\(?<Application>.+?(?=\\\))|(?:\\\\\\\172.168.1.2\\\Logs\\\(?<Application1>.+?(?=\\\))))" | eval Apps = coalesce(Application, Application1) | stats count by Apps | append [| gentimes start=-1 | eval Apps="App1#App2#App3#App4...all app names here separated by #" | table Apps | makemv Apps delim="#" | mvexpand Apps | eval count=0 ] | stats sum(count) as count by Apps | eval hasevents= if (count>=1,"YES","NO") | join [search index=saq source=* | search ("error" OR "Timeout") | rex field=source "(?:\\\\\\172.168.1.1\\\Logs\\\Production\\\*\\\(?<Application>.+?(?=\\\))|(?:\\\\\\\172.168.1.2\\\Logs\\\(?<Application1>.+?(?=\\\))))" | eval Apps = coalesce(Application, Application1) | stats count by Apps | append [| gentimes start=-1 | eval Apps="App1#App2#App3#App4...all app names here separated by #" | table Apps | makemv Apps delim="#" | mvexpand Apps | eval count=0 ] | stats sum(count) as errorcount by Apps | eval Errors= if (errorcount>=1,"YES","NO") ] First, it took long time to return results, second the Apps names are repeated multiple times. So, I think I didn't make it correct. Is there any way to get the errors count from subsearch and add that to the main search to get the below output ? Desired Output App count hasevents Errors ---------------------------------------------------------------------------------------- B2B 101 YES Yes Silverlight 95 YES NO B2C 102 YES NO Ldoc 40 NO NO in short [hasevents column will scan for all logs, errors column only scan for specified errors.] ... View more

I am trying to extract one name from source using rex. index=*source=* | rex field=source "\\\\\\\domain\\\prod\\\(?<Application>.+?(?=\\\)) Above query list me the application names from the source. But now I want to join another different source. \\\\\\domain\\\Logs\\\Prod\\\cluster1\\\(?<Application>.+?(?=\\\))" So I tried joining both the rex to get the Application names. index=* source=* | rex field=source "\\\\\\\domain\\\prod\\\(?<Application>.+?(?=\\\)) & \\\\\\domain\\\Logs\\\Prod\\\cluster1\\\(?<Application>.+?(?=\\\))" I thought it will extract the names from both the source locations but it is not working. ... View more