Splunk Enterprise

Why can't I use trellis with mstats?

robertlynch2020
Influencer

I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"

 

 

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics"  BY severity

 

 

 

 

robertlynch2020_0-1658329597522.png

robertlynch2020_0-1658329766728.png

 

 

Labels (1)
0 Karma
1 Solution

robertlynch2020
Influencer

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

View solution in original post

0 Karma

robertlynch2020
Influencer

in the end i needed to add a stats to the end of my SPL to get this to work

 

| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount

0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Community Feedback

We Want to Hear from You! Share Your Feedback on the Splunk Community   The Splunk Community is built for you ...

Manual Instrumentation with Splunk Observability Cloud: Implementing the ...

In our observability journey so far, we've built comprehensive instrumentation for our Worms in Space ...