topic Re: query for the count basedo the server in Splunk Search

query for the count basedo the server

kteng2024 — Wed, 15 Nov 2017 19:01:36 GMT

Hi,

Below is the sample logs and I want to see the how many events generated from each server. Since there are different servers with different format , field extractions is not working . Can I please know how to write a query to display events generated by each server.

(highlighted are the server names)

2016-11-15 13:35,123124e3,ADA,22361,jobtype event Jun 08 17:23:53 EDT 2017,admin,COMPLETED,2017-11-15 00:00:00.000,2017-11-15 00:00:00.000,2017-11-15 00:00:59.372,2017-11-15 00:00:59.564,apache34,,0,P3,

Re: query for the count basedo the server

rphillips_splk — Wed, 15 Nov 2017 19:16:46 GMT

since your events are comma delimited you could use Splunk's search time field extractor in the GUI to extract all of the fields and name them what you like. For example if you are using server as a field name you would then have a search that looks like:

index=x sourcetype=y | stats count by server

In most cases the host field in the event is what you would use unless you've got another scenario where the host field is another host such as your HF or syslog receiver

Re: query for the count basedo the server

rphillips_splk — Wed, 15 Nov 2017 19:18:32 GMT

to access the built in field extractor in the GUI:
search for those events and then in the event you will see the Event Actions pulldown > Extract Fields

Re: query for the count basedo the server

kteng2024 — Wed, 15 Nov 2017 19:29:46 GMT

thank you for the reply.. but extracting the server is difficult as servers doesn't have constant name.

Re: query for the count basedo the server

cpetterborg — Wed, 15 Nov 2017 19:45:00 GMT

Without extracting the hostname field that you want, you cannot do what you want. You can't count something that you can't distinguish. If all you can see is that they are animals, then you can't count the number of birds, because you can't tell a bird from an elephant.

It should be possible to extract the hostname into a field even if there are different formats. Since the events that you supplied were of the same format, please provide a few examples of the different formats, and perhaps we can help you get the file extraction working.