topic Re: Custom Splunk query in Splunk Search

Custom Splunk query

Ash1 — Sat, 16 Mar 2024 22:03:27 GMT

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes

Form the above query i am getting the results of service and application_codes.

But my requirement is to get the application_codes from a csv file and from only type=error1

below is the csv file

ITWhisperer — Sat, 16 Mar 2024 22:13:40 GMT

Try lookup of application_codes in csv and then filter by type

Ash1 — Sat, 16 Mar 2024 22:21:05 GMT

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes |lookup app.csv application_codes

when i run the above query i am getting application_codes from mstats query not from csv file

ITWhisperer — Sat, 16 Mar 2024 22:44:15 GMT

Please can you give an example of your expected results?

Ash1 — Sat, 16 Mar 2024 23:50:26 GMT

application_codes

1206

1729

i want to see only the above application codes, that is from csv file only.

yuanliu — Sun, 17 Mar 2024 01:12:44 GMT

For this problem, using the lookup in subsearch is more direct and potentially more efficient.

|mstats sum(faliure.count) as Failed where index=metric-logs by service application_codes | search type = error1 [inputlookup app.csv]

ITWhisperer — Sun, 17 Mar 2024 10:39:03 GMT

If you just want the application codes, why are you doing the mstats?

| inputlookup app.csv | where Type="error1" | table application_codes