Splunk Search

Table for Linux Message Log Error and Warning Logs

marendra
Explorer

Hi

I have quite number of Linux machine and I have sent their logs to my Splunk. The scenario is I would like to get the table similar like below:

Hostname Errors Warnings

HostA 4 4

HostB 44 1

I twisted my brain to do this since I am new to Splunk. Not like Windows, Windows log has Type field, where Linux log messages never categorize the log criticality. So I need to do my self. This is the one that I do:

sourcetype="messages" fail | stats count as fails by host | join host [search sourcetype="messages" error | stats count as errs by host] | stats values(fails), values(errs) by host | rename values(fails) as Failures | rename values(errs) as Errors | rename host as Hostname

It works and I can put in the table. But, When I click it, it will come out with no result. Is ther any better way? or is there a way to put html link below my table on my dashboard, for example, drilldown. So user can just click that one and I can turn of the drilldown in the table.

Please help

Thanks a lot

Tags (2)
0 Karma

somesoni2
Revered Legend

So it seems like the default drilldown from your dashboard table is not passing the whole query/correct query to flashtimeline, so you are getting no data. you might have a Redirector module within your table module. you can configure it to pass the exact query that you want to pass in the arg.q parameter. You can customize it with the row/field user clicked.

 <module name="Redirector">
      <param name="popup">True</param>
      <param name="url">flashtimeline</param>
      <param name="arg.earliest">$search.timeRange.earliest$</param>
      <param name="arg.latest">$search.timeRange.latest$</param>
      <param name="arg.q">search index=$index$ sourcetype="$sourcetype$" source="$source$" $click.fields.Field Name$</param>
</module>
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...