Splunk Search

Table for Linux Message Log Error and Warning Logs

marendra
Explorer

Hi

I have quite number of Linux machine and I have sent their logs to my Splunk. The scenario is I would like to get the table similar like below:

Hostname Errors Warnings

HostA 4 4

HostB 44 1

I twisted my brain to do this since I am new to Splunk. Not like Windows, Windows log has Type field, where Linux log messages never categorize the log criticality. So I need to do my self. This is the one that I do:

sourcetype="messages" fail | stats count as fails by host | join host [search sourcetype="messages" error | stats count as errs by host] | stats values(fails), values(errs) by host | rename values(fails) as Failures | rename values(errs) as Errors | rename host as Hostname

It works and I can put in the table. But, When I click it, it will come out with no result. Is ther any better way? or is there a way to put html link below my table on my dashboard, for example, drilldown. So user can just click that one and I can turn of the drilldown in the table.

Please help

Thanks a lot

Tags (2)
0 Karma

somesoni2
Revered Legend

So it seems like the default drilldown from your dashboard table is not passing the whole query/correct query to flashtimeline, so you are getting no data. you might have a Redirector module within your table module. you can configure it to pass the exact query that you want to pass in the arg.q parameter. You can customize it with the row/field user clicked.

 <module name="Redirector">
      <param name="popup">True</param>
      <param name="url">flashtimeline</param>
      <param name="arg.earliest">$search.timeRange.earliest$</param>
      <param name="arg.latest">$search.timeRange.latest$</param>
      <param name="arg.q">search index=$index$ sourcetype="$sourcetype$" source="$source$" $click.fields.Field Name$</param>
</module>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...