Splunk Enterprise

Why can't I use trellis with mstats?

robertlynch2020
Motivator

I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"

 

 

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics"  BY severity

 

 

 

 

robertlynch2020_0-1658329597522.png

robertlynch2020_0-1658329766728.png

 

 

Labels (1)
0 Karma
1 Solution

robertlynch2020
Motivator

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

View solution in original post

0 Karma

robertlynch2020
Motivator

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...