Dashboards & Visualizations

appPool name not showing if it has a space in it

stuconz
Explorer

Hi,
I am new to Splunk and I am setting up a dashboard to show when an application pool was last recycled and why. Most of the app pools I am querying have a space in the name (eg, "Process Tracking Service"), so when the query completes, it only shows app pools without a space in the name (eg, "Enrolment").

My query is below:
SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(?\S*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Try this:

SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(?<appPool>[^']*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host

All the best

View solution in original post

chrisyounger
SplunkTrust
SplunkTrust

Try this:

SourceName="Microsoft-Windows-WAS" host="server" | search recycle | rex field=Message "application pool '(?<appPool>[^']*)'" | eval host=upper(host) | eval reason=case(EventCode=5074, "Worker process reached processing time limit", EventCode=5075, "Worker process reached processing request limit", EventCode=5076, "Scheduled recycle", EventCode=5077, "Worker process reached processing virtual memory limit", EventCode=5079, "Manual recycle", EventCode=5080, "Config changes forced recycle", EventCode=5186, "Worker process was shut down due to inactivity") | rename appPool as "App Pool" | table _time host "App Pool" EventCode reason Message | sort by host

All the best

stuconz
Explorer

perfect. thanks for that

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...