Splunk Search

How to write a search to only list servers that are sending logs to Splunk with two types of error messages?

sreejithchmd
New Member

Hi,

I have server message logs sending to Splunk. Eg 1000 servers sending logs at a time. Wanted to find a way to list only the servers which have two types of error appearing in its message files. Both the errors are not in a single line of a message file.

eg:

2016-04-26T13:57:25.940706-07:00 host1 mpath disk disconnected 
2016-04-26T13:57:25.940706-07:00 host1 < other general messages >
----
2016-04-26T13:57:25.940706-07:00 host1 Driver Error 0x1:10

My search should pick all the servers with logs that have BOTH disconnected AND Error 0x1:10 Messages existing. How would I combine these strings for a search? If I do AND search, it shows servers with both entries present in same line.

Thanks in advance.

-SG

0 Karma

sundareshr
Legend

Try this

your search here | rex "(?<err>disconnected|0x1:10)" | search err=* | streamstats count as group by host | stats count by host group | where count>1 | table host
0 Karma

sreejithchmd
New Member

Looks like this is not helping .. any ways of combining two queries together to filter this ?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...