Splunk Search

Display field uniques in search

Path Finder

Hi there,

What I am after is quite straight forward really. I am trying to conduct a search of a particular index (prod_apache) and display any "File does not exist" errors.

This is very easy to accomplish (obviously)... however, I don't want to display the same file over and over again and would just like to display a list of which files don't exist.

Being that this seems like quite a straight forward thing to do (at least in my eyes) I was wondering if anyone knows how I would go about doing it.

Thanks, Aaron.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
index=prod_apache "File does not exist" | dedup file_name

Assuming you've got file_name extracted as a field containing the file name. Or:

index=prod_apache "File does not exist" | stats count by file_name

for a count of how many errors per file.

View solution in original post

Splunk Employee
Splunk Employee
index=prod_apache "File does not exist" | dedup file_name

Assuming you've got file_name extracted as a field containing the file name. Or:

index=prod_apache "File does not exist" | stats count by file_name

for a count of how many errors per file.

View solution in original post

Path Finder

Thanks again for your help.
After I configured the extraction, it worked perfectly.

0 Karma