topic Re: Need a help with Query in Splunk Search

Need a help with Query

SR — Thu, 30 Jan 2025 10:17:06 GMT

Below was the question for me
"I need a running report to be exported, with the number of errors on each of the services in the last 7 days then it has to show a graph for each week"

i would need a query to search for this Serivce "Per****ng.N**s.Platform.Host"
Index="Nex"
where i would need data for Information, Error, Debug, Warnings.

Please help me with this

Re: Need a help with Query

ITWhisperer — Thu, 30 Jan 2025 10:20:36 GMT

What have you tried so far?

Re: Need a help with Query

SR — Thu, 30 Jan 2025 10:29:43 GMT

Apologies i am pretty New to Splunk and i still learning and going through tutorials
just got till the below but no results yet

Index="Nex" Application="Pe***g.Ne**s.Platform.Host"| Search

Re: Need a help with Query

ITWhisperer — Thu, 30 Jan 2025 10:55:45 GMT

Asterisks are wild cards - are you really using wildcards or are you just obfuscating your search for the purposes of posting here?

It would also be very helpful if you could share some sample raw events, anonymised appropriately; please share them in a code block using the </> button to create an area to place them in so that formatting is preserved

Re: Need a help with Query

inventsekar — Thu, 30 Jan 2025 16:19:21 GMT

Hi @SR .. may i know if you get results for the first search.. if no, pls understand that Application= may be service= or something else(depends on your logs).

if your search fails, then pls check the search below:

do you get results for index="Nex" Application="Pe***g.Ne**s.Platform.Host" OR the better do this search index="Nex" "Pe***g.Ne**s.Platform.Host"

maybe pls send me a direct msg here in my profile, i can try to help you further. thanks.