topic Re: How to count errors for only a certain application? in Splunk Search

How to count errors for only a certain application?

lsy9891 — Wed, 30 Sep 2020 01:57:22 GMT

Hi, my query returns exceptions thrown by every application. How do I filter this query to display only certain applications like Application="jobs"?

(index= OR index=_) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\+(?.*?).+monster" | timechart span=1h count by Application

Re: How to count errors for only a certain application?

renjith_nair — Thu, 29 Aug 2019 12:43:40 GMT

@lsy9891,

Have you tried adding the condition to the base search ?

ie.

  (index= OR index=_) ......... Application="jobs" earliest=-7d@d latest=@d

If there are multiple applications , you could try with OR or IN

Re: How to count errors for only a certain application?

Sukisen1981 — Thu, 29 Aug 2019 12:47:31 GMT

what all have you tried so far @lsy9891 ?

Re: How to count errors for only a certain application?

somesoni2 — Thu, 29 Aug 2019 13:41:06 GMT

You basically need to apply the filter based on Application field. If the field Application is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere" in the base search. If The field Application is not already extracted and you're extracting it via that rex command in your search, you'll apply filter after the field is extracted.

Base search filter:

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application

Filter after subsearch

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application