Splunk Enterprise

Why can't I use trellis with mstats?

robertlynch2020
Motivator

I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"

 

 

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics"  BY severity

 

 

 

 

robertlynch2020_0-1658329597522.png

robertlynch2020_0-1658329766728.png

 

 

Labels (1)
0 Karma
1 Solution

robertlynch2020
Motivator

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

View solution in original post

0 Karma

robertlynch2020
Motivator

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...