Splunk Search

Search query for syslog in dashboard

Hey all,

Am in a need of dashboard to see my syslog traffic for four arista switches as mentioned below:

AA-UKD-AA-SW01 :- Port 3050
AA-UKD-AA-SW02 :- Port 3051
AA-UKM-AA-SW01 :- Port 3052
AA-UKM-AA-SW02 :- Port 3053

Added search query as:

index=inf* sourcetype=syslog host=AA-UKD-AA-SW* OR host=AA-UKM-AA-SW* | timechart span=1m count by host

Does the above mentioned query is right?

Thanks in advance.

0 Karma
1 Solution

Builder

Hi @mkrishnamoorthy ,
If you're looking for the count of syslog events for each device broken down per minute over time, then this is the right search. Generally, you don't need to specify a span= value for timechart because it automatically picks the most appropriate value given the time range used in the search.

View solution in original post

Builder

Hi @mkrishnamoorthy ,
If you're looking for the count of syslog events for each device broken down per minute over time, then this is the right search. Generally, you don't need to specify a span= value for timechart because it automatically picks the most appropriate value given the time range used in the search.

View solution in original post

Splunk Employee
Splunk Employee

This will show the number of events over time by host. Is that what you are trying to do? Or is there a value in the events that you want to sum for each host?

0 Karma

yes, am looking for number of events. I think am right.

0 Karma