Splunk Search

By intersect, I am getting a list of hosts, but how can I use that list to get the count of errors per host?

kartik13
Communicator

Hi,

By using intersect i got the list of hosts. now i want to to get the list of errors in those host. how can i achieve that .

0 Karma
1 Solution

NOUMSSI
Builder

Hi,

I also advice you to use a subsearch to filter the main query. this will look at this:

... [search index=name_of_your_index |stats count(error) by host]

Replace the ... by your main search

View solution in original post

NOUMSSI
Builder

Hi,

I also advice you to use a subsearch to filter the main query. this will look at this:

... [search index=name_of_your_index |stats count(error) by host]

Replace the ... by your main search

gfuente
Motivator

Hello

You can use a subsearch to filter the main query, leike this:

YourBaseSearchToFilterErrors [search YourIntersectSearchThatReturnsAListOfHosts] | any other commands

This will transalate into something like:

index=main "error" host=1 OR host=2 OR host=3 | other commands

Regards

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...