I found some similar questions on here, but not quite what I'm trying to do.
We have web access logs from several three different web servers (same host, though). I'd like to graph the number of unique hits from each web server on the same graph in a dashboard.
For example, one search is like this:
<searchString>host="xyz" sourcetype="*access*" source="*foo.access*" | timechart dc(remote_host)</searchString>
Another search/graph is like this:
<searchString>host="xyz" sourcetype="*access*" source="*bar.access*" | timechart dc(remote_host)</searchString>
I'd like both of these results to appear on the same graph. How can I do this?
You can simply OR them together, and then use the searchmatch function of eval to give yourself a field that indicates whether this is a source containing 'foo' or a source containing 'bar'.
(Im assuming there are a lot of difference sources matching the foo.access. condition, as well as a lot of sources matching the bar.access. condition.)
This should work:
host="xyz" sourcetype="*access*" ( source="*foo.access*" OR source="*bar.access*" ) | eval type=if(searchmatch(source="*foo.access.*"),"foo","bar") | timechart dc(remote_host) by type
NOTE: this is very similar to this other answer here: http://answers.splunk.com/questions/5423/comparing-values-returned-by-two-separate-searches/5439#543...
If you have angle brackets in the regex you need to either escape them, or preferably wrap them in a CDATA block. This link has an example of what CDATA looks like: http://www.quackit.com/xml/tutorial/xml_cdata.cfm
Thank you for the reply. The "by source" solution works, but the path is too long for it to show the entire source file.
I can't get the "rex field=source" solution to work. Every time I ever try to use a rex in an XML file, I get a "mismatched tag" error. Not sure how to get around that.
Thank you for the reply. I think "by host" should be "by source", no? That works but, as I said in my comment below, the path to the source file is too long so it gets abbreviated, making it impossible to tell which source is which on the graph...