Splunk Search

How to find more than 3 heartbeat failure with failure reason from same host in a day and put in a table?

navan1
Explorer

Hi All,

How to find more than 3 heartbeat failure with failure reason from same host in a day  and put in a table?

I am currently using below search,

Index="my index" sourcetype="my sourcetype" action="heartbeatfailure" 
|bucket _time span=day
|stats count by _time host action failure_reason
|where count>2 

As the failure reason is different i am unable to get result for the same host in  past 24 hrs.  How to get stats count by _time, host, action with failure_reason in same table?

Labels (2)
0 Karma

johnhuang
Motivator

One of these could work:

index="my index" sourcetype="my sourcetype" action="heartbeatfailure" 
| bucket _time span=1d
| eventstats count BY _time host action 
| table _time host action failure_reason count
| where count>2 
index="my index" sourcetype="my sourcetype" action="heartbeatfailure" 
| bucket _time span=1d
| stats count values(failure_reason) AS failure_reason BY _time host action
| table _time host action failure_reason count
| where count>2 

 

ITWhisperer
SplunkTrust
SplunkTrust
Index="my index" sourcetype="my sourcetype" action="heartbeatfailure" 
|bucket _time span=day
|stats count values(failure_reason) as failure_reason by _time host action
|where count>2
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...