topic Re: State Search Help in Splunk Search

State Search Help

RobertRi — Wed, 06 Oct 2010 15:53:25 GMT

I have a logfile which looks like this:

%Date %Time %Server %Application %State ("State UP" or "State DOWN")

If I try to find the last State for App1, i will use this search

App1 ("State UP" OR "State DOWN") | head 1

this will result in one event with State UP or DOWN

My problem now is that there are 50 Apps and I would like to show a list with all 50 Apps and there current states.

Could you please help me with this search

Thanks Rob

Re: State Search Help

RobertRi — Wed, 06 Oct 2010 16:26:31 GMT

I have tried the following which looks good
("State UP" OR "State DOWN") | stats first(state) by application

maybe you have an alternate solution ?

Re: State Search Help

sdwilkerson — Wed, 06 Oct 2010 18:12:47 GMT

RobertRi,

I am not sure from your message if your fields are properly extracted or not. If the fields that contain "Application" and "State" are extracted, then you could do a variety of things including:

SEARCH: sourcetype=YourSourcetype | table Application,State SEARCH: sourcetype=YourSourcetype | stats list State by Application

You should replace YourSourcetype with whatever the proper sourcetype is here.

You might want to add something like this at the end of your search | sort Application to alter the order your results are displayed.

Also, depending on how many events are in your index per Application you might need to do a dedup.

If your fields are not currently extracted, you should do that first so that the data is more usable.

Sean

Re: State Search Help

RobertRi — Fri, 08 Oct 2010 14:44:38 GMT

thank you for your help.

another question is, if it is possible to search within this stats output. I have tried many things without success.

("State UP" OR "State DOWN") | stats first(state) by application | search DOWN

I don't want the latest DOWN event because in the meantime a UP event could be written into the log, so I would try to catch only the latest State event witch have a DOWN value

Do you have a clue ?

Bye
Rob

Re: State Search Help

araitz — Sun, 30 Jan 2011 03:39:32 GMT

Check my blog post regarding maintaining state:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/