Splunk Search

Display field uniques in search

aaronnicoli
Path Finder

Hi there,

What I am after is quite straight forward really. I am trying to conduct a search of a particular index (prod_apache) and display any "File does not exist" errors.

This is very easy to accomplish (obviously)... however, I don't want to display the same file over and over again and would just like to display a list of which files don't exist.

Being that this seems like quite a straight forward thing to do (at least in my eyes) I was wondering if anyone knows how I would go about doing it.

Thanks, Aaron.

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
index=prod_apache "File does not exist" | dedup file_name

Assuming you've got file_name extracted as a field containing the file name. Or:

index=prod_apache "File does not exist" | stats count by file_name

for a count of how many errors per file.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
index=prod_apache "File does not exist" | dedup file_name

Assuming you've got file_name extracted as a field containing the file name. Or:

index=prod_apache "File does not exist" | stats count by file_name

for a count of how many errors per file.

aaronnicoli
Path Finder

Thanks again for your help.
After I configured the extraction, it worked perfectly.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...