topic Search query for syslog in dashboard in Splunk Search

Search query for syslog in dashboard

mkrishnamoorthy — Wed, 12 Jun 2019 23:58:47 GMT

Hey all,

Am in a need of dashboard to see my syslog traffic for four arista switches as mentioned below:

AA-UKD-AA-SW01 :- Port 3050
AA-UKD-AA-SW02 :- Port 3051
AA-UKM-AA-SW01 :- Port 3052
AA-UKM-AA-SW02 :- Port 3053

Added search query as:

index=inf* sourcetype=syslog host=AA-UKD-AA-SW* OR host=AA-UKM-AA-SW* | timechart span=1m count by host

Does the above mentioned query is right?

Thanks in advance.

Re: Search query for syslog in dashboard

kmorris_splunk — Thu, 13 Jun 2019 13:43:45 GMT

This will show the number of events over time by host. Is that what you are trying to do? Or is there a value in the events that you want to sum for each host?

Re: Search query for syslog in dashboard

jnudell_2 — Thu, 13 Jun 2019 14:00:44 GMT

Hi @mkrishnamoorthy ,
If you're looking for the count of syslog events for each device broken down per minute over time, then this is the right search. Generally, you don't need to specify a span= value for timechart because it automatically picks the most appropriate value given the time range used in the search.

Re: Search query for syslog in dashboard

mkrishnamoorthy — Fri, 14 Jun 2019 00:54:30 GMT

yes, am looking for number of events. I think am right.