Can you help me create a report based on the following attributes?

[viji261992]

Please help me to create a report with Devicename, corresponding error message and alert count.
We have more than 15,000 devices and the error message would be around 300, I need a report to be generated automatically every week.

[VatsalJagani]

@viji261992,
Try below queries:

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname, eventuei

And

index=index-name-here eventuei=* | stats count as "No of alerts" by hostname

Hope this helps!!!

[viji261992]

I tried the query
index=opennms sourcetype=events eventuei=* | stats count as "No of alerts" by hostname, eventuei

but i am not getting any results

[VatsalJagani]

looks like hostname is not being extracted from your events, can you please verify and check which field do you want instead of hostname?

[VatsalJagani]

We would be glad to help you @viji261992, but can you please provide sample data so we can help you create the report.

[viji261992]

Our splunk is receiving events from network devices, which contains hostname, eventuei="error reason", eventtime.
1. I need to create a report which display the hostname, corresponding error reason , eventtime and no. of alerts generated
2. I need to create a dashboard with device name in the x-axis no. of alerts in the y-axis
3. A complete dashboard which shows total no. of hosts in my company, no. of hosts working fine, no. of hosts are down based on error reason

[VatsalJagani]

For first two try query from my answer, for third I don't know how do you consider your host is working or not? What kind of messages are coming into your dat which can decide host is working? Do you have fix list of host?

[viji261992]

Yes we have a list of hosts available in a .csv file in the same file
'error message types" are provided. Based on the error message we decide whether the host is working or not.