Dashboards & Visualizations

How to add multiple attributes in single query

aditsss
Builder

Hi Everyone,

I have one requirement.

I am creating one alert and the query is below:

index=abc ns=blazepsfpublish "NullPointerException" | rex "message=(?<ExceptionMessage>[^\n]+)"|dedup ExceptionMessage,ns|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|table app_name, ExceptionMessage ,_time, environment, pod_name,ns|rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name

My requirement is that I have multiple 6-7 ns and I want to include them in same query rather then appending.

Can someone guide me on this .

Below are my ns names:

sidh-datagraph

datagraph

etc

How can I include all ns   in single query

Labels (3)
0 Karma
1 Solution

bowesmana
Champion

Use IN like this

index=abc ns IN ("blazepsfpublish", "sidh-datagraph", "datagraph") "NullPointerException" 

Or use OR like this

index=abc (ns="blazepsfpublish" OR ns="sidh-datagraph" OR ns="datagraph") "NullPointerException" 

Hope this helps

View solution in original post

bowesmana
Champion

Use IN like this

index=abc ns IN ("blazepsfpublish", "sidh-datagraph", "datagraph") "NullPointerException" 

Or use OR like this

index=abc (ns="blazepsfpublish" OR ns="sidh-datagraph" OR ns="datagraph") "NullPointerException" 

Hope this helps

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!