Splunk Search

Search a two messages from 6 hosts and show top 6 results

sandeepparcha44
Explorer

Hi

I am trying to search two strings in message like "Stopped successfully" and "connected" from 6 host names.

Please help me

am writing like below

Source="WinEventlog:applicaiton"

|rex "message\s(?<message>.*).*"

|search host like "host1" OR host Like "host2"

| search message="stopped succesfully" OR "Connected"

|table _time, host, message

Labels (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sandeepparcha44 

Can you please try this?

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*")
| rex field=_raw "Message=(?<message1>.*).*"
|table _time, host, message, message1

sandeepparcha44
Explorer

it worked , but i have to add

 

"Message=Event*(?<message1>.*).*

 

Thank you..

0 Karma

sandeepparcha44
Explorer

Still same,

sample message in the log will be like below

Message=Event : _*protocol* Name  : tcp://servername:port

0 Karma

sandeepparcha44
Explorer

Still same,

sample message in the log willbe like below

Message=Event : _*protocol* Name  : tcp://servername:port

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Are you spelling application wrong

WinEventlog:applicaiton

should be 

WinEventlog:application

sandeepparcha44
Explorer

it updated and resoled

0 Karma

sandeepparcha44
Explorer

Thank you Kamalesh, its working for Hosts.

but am not getting "message"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sandeepparcha44 

I have updated my answer. Can you please try it?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sandeepparcha44 

Try like this,

 

Source="WinEventlog:applicaiton" (host="host1*" OR host="host2*") (message="*stopped succesfully*" OR message="*Connected*")
| rex field=_raw "message\s(?<message1>.*).*" 
|table _time, host, message, message1

 

 

KV 

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...