topic how to show data with 2 different fields in Splunk Search

how to show data with 2 different fields

sunnyparmar — Tue, 23 Jun 2015 10:02:12 GMT

Hi,

I have two types of parameters in my logs i.e. "Batch received successfully" and "could not be found" now i want to make dashboard with the help of these logs in which it will show data for hosts with these parameters like it will show that how many logs are coming on hourly basis with these parameters. There are two hosts from where the data coming so I have made query but not showing the proper output which I want.

index="sc-kofax" sourcetype="sc-kofax-sv-acis" "Batch received successfully" OR "could not be found" | Stats count by host

Thanks
Ankit

Re: how to show data with 2 different fields

vganjare — Tue, 23 Jun 2015 10:38:51 GMT

Hi,

Use Field extractor for extracting different fields for "Batch received successfully" & "could not be found" (http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX), use these fields in query.

Lets say, "Batch received successfully"=SUCCESS and "could not be found" = FAILURE, then the query will look like:

index="sc-kofax" sourcetype="sc-kofax-sv-acis" SUCCESS=*  OR FAILURE=* | Stats count by host

Thanks!!

Re: how to show data with 2 different fields

sunnyparmar — Tue, 23 Jun 2015 10:44:03 GMT

Thanks for answering but Given link is not working.

Re: how to show data with 2 different fields

alekksi — Tue, 23 Jun 2015 10:51:07 GMT

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX

Re: how to show data with 2 different fields

fdi01 — Tue, 23 Jun 2015 10:57:07 GMT

try like :

index="sc-kofax" sourcetype="sc-kofax-sv-acis"  | Stats count(eval("Batch received successfully")) as "count of Batch received successfully" count(eval("could not be found")) as "count of could not be found" by host

Re: how to show data with 2 different fields

sunnyparmar — Tue, 23 Jun 2015 11:21:17 GMT

Hey .. thanks once again.. you solved my problem..