Knowledge Management

How do you write a correlation search with a data model?

test_qweqwe
Builder

Hello my little friends.
I have logs from tomcat and they joined Web Data Model, so that means that I can write correlation search by using a data model.

For example, I have this search:

sourcetype="tomcat:access:log" request_uri="*struts2-rest-showcase*" AND status="500" | stats latest(_raw) as "orig_raw" values(request_uri) as "uri" values(http_method) as method values(status) as status count by "host", "src"

And I want to remake this search using Data Model and right now I have no idea how to do it.

I I've looked at many default correlation searches by ESS to understand how to write my own search and dat searches by so advance level that I even don't understand how they work 😞

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this;

| tstats summariesonly=t values(Web.url) AS url values(Web.http_method) AS method
WHERE Web.url="*struts2-rest-showcase*" AND Web.status="500"
BY Web.host Web.src

Do note that constraining to 500 means that the other status stuff is pointless because it will always be 500

View solution in original post

woodcock
Esteemed Legend

Try this;

| tstats summariesonly=t values(Web.url) AS url values(Web.http_method) AS method
WHERE Web.url="*struts2-rest-showcase*" AND Web.status="500"
BY Web.host Web.src

Do note that constraining to 500 means that the other status stuff is pointless because it will always be 500

test_qweqwe
Builder

this search not working, but I see how it's looks, tnx!

0 Karma

test_qweqwe
Builder

Maybe I'm wrong but I think if I will remake search that in my OP post by using Data Model it's will solve my another question.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...