Splunk Enterprise

Why can't I use trellis with mstats?

robertlynch2020
Influencer

I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"

 

 

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics"  BY severity

 

 

 

 

robertlynch2020_0-1658329597522.png

robertlynch2020_0-1658329766728.png

 

 

Labels (1)
0 Karma
1 Solution

robertlynch2020
Influencer

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

View solution in original post

0 Karma

robertlynch2020
Influencer

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...