Greetings,
I want to report on any Linux system that hasn't had an event in /var* for 30 minutes. I was going to use Source="/var/log/messages" but our admins told me that they want anything below /var to be reported on. I tried using the metadata command but that didn't get me anywhere. Does anyone have any suggestions? Thanks.
| tstats count as Counts where source="/var/*" by source host
| inputlookup append=t your_host.csv
| stats values(Counts) as count by source host
| fillnull count
| where count=0
your_host.csv:
host,source
A,/var/log/messages
A,/var/log/
B,/var/log/messages
B,....
Field name is case sensitive. Source
is wrong.
I don't know what's gold. so both source and host is aggregated.
Thanks. Will a wildcard in the CSV file work? Could the source be /var/log/*
between no2 and no3,
| rex mode=sed field=source "s/\/\w+/\/*/3"
to force them to match.
Thanks but I must be doing something wrong. I've added a lookup file with the format:
host, source
host1, /var/log*
host2, /var/log*
I've done your search:
| tstats count as Counts where index=[my index] source="/var/log*" by host
| inputlookup append=t May_Linux_Hosts.csv
| rex mode=sed field=source "s/\/\w+/\/*/3"
| stats values(Counts) as count by source host
| fillnull count
| where count=0
And the output I get is:
source, host, count
/var/log/, host1,0
/var/log/, host2,0
.
.
.
So it's like it's not treating the * as a wildcard. Any idea what I'm doing wrong?
your comment: /var/log/*
now: var/log*
| rex mode=sed field=source "s/\/\w+/\/*/3"
→ | rex mode=sed field=source "s/(\/var\/log).*/\1*/"
We use regular expressions, so even the slightest difference won't work.
Thanks for the help. Still producing same output with the following search. I guess I don't know enough about regex to troubleshoot. I was even going to regex101.com to test without any luck:
| tstats count as Counts where index=ahc_os source="var/log*" by host
| inputlookup append=t May_Linux_Hosts.csv
| rex mode=sed field=source "s/(\/var\/log)./\1/"
| stats values(Counts) as count by source host
| fillnull count
| where count=0
It jacked the formatting of the rex line up. I cut and paste exactly like you showed, but it doesn't look that way in my response.
check your source
value after rex