Hello Splunkers,
I am trying to compose a search to do the following and create a table based off of the results:
Essentially the customer wants to eliminate noise. They are only concerned with events that have happened a certain number of times within a specific time period. If a certain thresh hold is met, show me the event in a table. They deal with port flapping constantly but don't want to be alerted every time a port flaps. If a port flaps 2000 times, yes alert me. Build a table based off of this criteria, then provide filtering via drop down.
Hopefully that makes sense. I don't even know where to start with this one.
Thanks!
Supposing the time period they want to check against the count of X is hourly
| bin _time span=1h
| stats count by _time, host, eventtype, interface, message_text
| where count > X
That creates your summary records for each hour that exceeded the threshold of X.
With that as your base search, you'll load your dropdowns with distinct available values of host, eventtype and interface. Not sure if message_text is reasonable to go into a dropdown, your call.
Supposing the time period they want to check against the count of X is hourly
| bin _time span=1h
| stats count by _time, host, eventtype, interface, message_text
| where count > X
That creates your summary records for each hour that exceeded the threshold of X.
With that as your base search, you'll load your dropdowns with distinct available values of host, eventtype and interface. Not sure if message_text is reasonable to go into a dropdown, your call.
DaJeanis This is EXACTLY what i was looking for.
Thank you so much
You are quite welcome.
Hi jcspigler,
1. ... | stats count by host eventtype message_text interface | where count > X
2. ... | table _time,host,eventtype,message_text,interface
3. use form inputs for a dashboard by creating a token. I like to use the examples at the dashboard app. download here: https://splunkbase.splunk.com/app/1603/
hope it helps
Thanks Adonio. I'll try it this weekend. Had to run out of the office this afternoon.
Cheers