topic How to write a search to correlate an eventcode from index1 with errors that show up in index2? in Getting Data In

How to write a search to correlate an eventcode from index1 with errors that show up in index2?

icur2ys4ye — Wed, 08 Apr 2015 00:11:51 GMT

So I have a problem and I can't seem to crack it.

index=index1 host=server* EventCode=1234 |localize maxpause=1m| map search="search index=index2 host=server* errortext starttimeu=$starttime$ endtimeu=$endtime$" | stats count(host) by host

I'm trying to correlate the eventcode 1234 in index1 with errors that show up in index2

I need help capturing the "host names" which are the same in both indexes so I can correlate exactly. The problem is that index2 throws this particular error text, but it's generally not a problem unless it occurs around eventcode 1234

I tried a join:

index=index 1 host=server* EventCode=1234| stats values(host) by _time | join host [search index=index2 host=server* errortext

this doesn't work out because it doesn't have any sort of time context of the eventcode vs the error

I tried this as well, but was unable to get it to work:

index=index2 host=server* errortext [search index=ssapevent host=server* EventCode=1234| rename _time AS earliest | eval earliest=latest + 60| fields earliest, latest]

Re: How to write a search to correlate an eventcode from index1 with errors that show up in index2?

stephanefotso — Wed, 08 Apr 2015 04:55:42 GMT

Hello!
First a question. How do you use your starttimeu=$starttime$ endtimeu=$endtime$?
I think, for it to work, you must have something like this bellow, with starttime and endtime as fields in your index1 events:

index=index1 host=server* EventCode=1234 starttime=...  endtime=....| map search="search index=index2 host=server* errortext starttimeu=$starttime$ endtimeu=$endtime$" | stats count(host) by host

And, starttimeu and endtimeu must be fields int your index2 events, and must respectively have same values with starttime and endtime. If that is not the case, remove that starttimeu=$starttime$ endtimeu=$endtime$ in your code.

Ok. To capture the host names, that is what you can do.

index=index1 host=server* EventCode=1234 | map search="search index=index2 host=$host$ errortext" | stats count(host) by host

here is one example with the _internal and _audit indexes.

index=_internal sourcetype=* user=*|map search="search index=_audit user=$user$" error|stats count(user) by user