topic Re: Search a two messages from 6 hosts and show top 6 results in Splunk Search

Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Sun, 25 Jul 2021 06:20:34 GMT

I am trying to search two strings in message like "Stopped successfully" and "connected" from 6 host names.

Please help me

am writing like below

Source="WinEventlog:applicaiton"

|rex "message\s(?<message>.*).*"

|search host like "host1" OR host Like "host2"

| search message="stopped succesfully" OR "Connected"

|table _time, host, message

Re: Search a two messages from 6 hosts and show top 6 results

kamlesh_vaghela — Wed, 28 Jul 2021 09:35:12 GMT

@sandeepparcha44

Try like this,

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*") | rex field=_raw "message\s(?<message1>.*).*" |table _time, host, message, message1

Re: Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Wed, 28 Jul 2021 09:31:55 GMT

Thank you Kamalesh, its working for Hosts.

but am not getting "message"

Re: Search a two messages from 6 hosts and show top 6 results

kamlesh_vaghela — Wed, 28 Jul 2021 09:35:43 GMT

@sandeepparcha44

I have updated my answer. Can you please try it?

Re: Search a two messages from 6 hosts and show top 6 results

bowesmana — Wed, 28 Jul 2021 09:39:31 GMT

Are you spelling application wrong

WinEventlog:applicaiton

should be

WinEventlog:application

Re: Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Wed, 28 Jul 2021 09:40:10 GMT

Still same,

sample message in the log willbe like below

Message=Event : _*protocol* Name : tcp://servername:port

Re: Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Wed, 28 Jul 2021 09:41:06 GMT

it updated and resoled

Re: Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Wed, 28 Jul 2021 09:42:44 GMT

Still same,

sample message in the log will be like below

Message=Event : _*protocol* Name : tcp://servername:port

Re: Search a two messages from 6 hosts and show top 6 results

kamlesh_vaghela — Wed, 28 Jul 2021 09:49:41 GMT

@sandeepparcha44

Can you please try this?

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*") | rex field=_raw "Message=(?<message1>.*).*" |table _time, host, message, message1

Re: Search a two messages from 6 hosts and show top 6 results

sandeepparcha44 — Wed, 28 Jul 2021 09:53:43 GMT

it worked , but i have to add

"Message=Event*(?<message1>.*).*

Thank you..