Knowledge Management

How do you write a correlation search with a data model?

test_qweqwe
Builder

Hello my little friends.
I have logs from tomcat and they joined Web Data Model, so that means that I can write correlation search by using a data model.

For example, I have this search:

sourcetype="tomcat:access:log" request_uri="*struts2-rest-showcase*" AND status="500" | stats latest(_raw) as "orig_raw" values(request_uri) as "uri" values(http_method) as method values(status) as status count by "host", "src"

And I want to remake this search using Data Model and right now I have no idea how to do it.

I I've looked at many default correlation searches by ESS to understand how to write my own search and dat searches by so advance level that I even don't understand how they work 😞

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this;

| tstats summariesonly=t values(Web.url) AS url values(Web.http_method) AS method
WHERE Web.url="*struts2-rest-showcase*" AND Web.status="500"
BY Web.host Web.src

Do note that constraining to 500 means that the other status stuff is pointless because it will always be 500

View solution in original post

woodcock
Esteemed Legend

Try this;

| tstats summariesonly=t values(Web.url) AS url values(Web.http_method) AS method
WHERE Web.url="*struts2-rest-showcase*" AND Web.status="500"
BY Web.host Web.src

Do note that constraining to 500 means that the other status stuff is pointless because it will always be 500

test_qweqwe
Builder

this search not working, but I see how it's looks, tnx!

0 Karma

test_qweqwe
Builder

Maybe I'm wrong but I think if I will remake search that in my OP post by using Data Model it's will solve my another question.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...