Folks
I am new in splunk so pardon the basic question here. I am trying to find in my application what are the new errors over the past 24 hours that we never encountered in the past week. Here is my current search:
CASE(ERROR) earliest=-24h@h latest=now | stats count as errsToday by class source linecount | sort by class source linecount | appendcols [ search CASE(ERROR) earliest=-8d@d latest=-24h@h | stats count as errsLastWeek by class source linecount| sort by class source linecount ] | eval errsLastWeek=if(isnull(errsLastWeek),0,errsLastWeek) | eval errsToday=if(isnull(errsToday),0,errsToday) | table errsLastWeek errsToday class source linecount
My question is if anyone has comments on the above search and assuming it is correct, I have the following problem. In the results I get lines as follows:
errsLastWeek errsToday class source linecount
3 4 Foo foo.txt 5
5 0 Foo foo.txt 5
I would like to process further so I get:
errsLastWeek errsToday class source linecount
8 4 Foo foo.txt 5
thanks in advance for the advice
-a
What field identifies whether the event is an error? You should start your search like this:
sourcetype=foo fieldname=ERROR
If you need class, source and linecount info I would do it like this:
Set the timerangepicker to earliest=-7d@d latest=now
sourcetype=foo fieldname=ERROR
| eval today=relative_time(now(),"@d")
| stats count(eval(if(_time<today, _time, null()))) AS errors_last_week,
count(eval(if(_time>=today, _time, null()))) AS errors_today BY class, source, linecount
| eval new_error=if(errors_last_week=0, "true", "false")
What field identifies whether the event is an error? You should start your search like this:
sourcetype=foo fieldname=ERROR
If you need class, source and linecount info I would do it like this:
Set the timerangepicker to earliest=-7d@d latest=now
sourcetype=foo fieldname=ERROR
| eval today=relative_time(now(),"@d")
| stats count(eval(if(_time<today, _time, null()))) AS errors_last_week,
count(eval(if(_time>=today, _time, null()))) AS errors_today BY class, source, linecount
| eval new_error=if(errors_last_week=0, "true", "false")
Thanks man! I appreciate it. Worked great