query on splunk for new error(exeption on server)

sagineshmk — Mon, 03 Oct 2016 08:00:06 GMT

Hi,

Requires a query that search for non-repetitive error/exception on server ie it will show only new error that has not occured more than 30 days.

Regards,
SAGINESH

Re: query on splunk for new error(exeption on server)

jhupka — Tue, 29 Sep 2020 11:16:27 GMT

There's a lot of different ways to approach this - are you planning on creating an alert from a scheduled search running every 15m? Do you want to just create a dashboard with uncommon or recent errors? What do you want to tell the consumer of the search result about the error - what host it came from? The error itself? Any other info?

For now we can choose a simple case. Let's assume your data's sourcetype is sagineshmk_logs, and the error is in a field named error_name. You could do a search like the following:

sourcetype=sagineshmk_logs earliest=-30d@d | stats count as error_count, max(_time) as _time by error_name | where error_count=1

For a production environment, though, I might not want to run the above search every 15m and constantly look over 30 days of data. In that case I may split the search into two separate pieces - one search to compile a list of unique errors in the last 30 days (e.g. run that daily), then a second search that only looks at the past 15 minute's worth of errors and compares it to my daily unique error list.

Re: query on splunk for new error(exeption on server)

sloshburch — Wed, 05 Oct 2016 14:43:04 GMT

@sagineshmk, did this answer your question? If so, you can "accept" this or provide clarifying information to continue the discussion.

topic Re: query on splunk for new error(exeption on server) in Splunk Search

query on splunk for new error(exeption on server)

Re: query on splunk for new error(exeption on server)

Re: query on splunk for new error(exeption on server)