Table for Linux Message Log Error and Warning Logs

marendra — Thu, 19 May 2011 08:39:47 GMT

I have quite number of Linux machine and I have sent their logs to my Splunk. The scenario is I would like to get the table similar like below:

Hostname Errors Warnings

HostA 4 4

HostB 44 1

I twisted my brain to do this since I am new to Splunk. Not like Windows, Windows log has Type field, where Linux log messages never categorize the log criticality. So I need to do my self. This is the one that I do:

It works and I can put in the table. But, When I click it, it will come out with no result. Is ther any better way? or is there a way to put html link below my table on my dashboard, for example, drilldown. So user can just click that one and I can turn of the drilldown in the table.

Please help

Thanks a lot

Re: Table for Linux Message Log Error and Warning Logs

somesoni2 — Fri, 15 Nov 2013 16:36:17 GMT

So it seems like the default drilldown from your dashboard table is not passing the whole query/correct query to flashtimeline, so you are getting no data. you might have a Redirector module within your table module. you can configure it to pass the exact query that you want to pass in the arg.q parameter. You can customize it with the row/field user clicked.

 <module name="Redirector">
      <param name="popup">True</param>
      <param name="url">flashtimeline</param>
      <param name="arg.earliest">$search.timeRange.earliest$</param>
      <param name="arg.latest">$search.timeRange.latest$</param>
      <param name="arg.q">search index=$index$ sourcetype="$sourcetype$" source="$source$" $click.fields.Field Name$</param>
</module>

topic Re: Table for Linux Message Log Error and Warning Logs in Splunk Search

Table for Linux Message Log Error and Warning Logs

Re: Table for Linux Message Log Error and Warning Logs