How to count errors for only a certain application?

[lsy9891]

Hi, my query returns exceptions thrown by every application. How do I filter this query to display only certain applications like Application="jobs"?

(index= OR index=_) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\+(?.*?).+monster" | timechart span=1h count by Application

[somesoni2 · Accepted solution]

You basically need to apply the filter based on Application field. If the field Application is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere" in the base search. If The field Application is not already extracted and you're extracting it via that rex command in your search, you'll apply filter after the field is extracted.

Base search filter:

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application

Filter after subsearch

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application

[renjith_nair]

@lsy9891,

Have you tried adding the condition to the base search ?

ie.

  (index= OR index=_) ......... Application="jobs" earliest=-7d@d latest=@d 

If there are multiple applications , you could try with OR or IN

[Sukisen1981]

what all have you tried so far @lsy9891 ?