Splunk Search

Unique host list but only when the # of hosts is < some #. To be used for alert content (inline table)

sjringo
Path Finder

index=anIndex sourcetype=aSourceType ("*Starting application:*" AND (host="aHostName*")) | stats values(host) AS ServerList

The above query gives me a list of distinct server names.  What I am attempting to do is use this query for an alert and provide the list of server's but only when the # of servers in the distinct list returned in the above query is less than a specified #.

I will be configuring the alert to trigger when the results are > 0 since the trigger condition will be in the query and not the alert.

How do I modify the query above to only provide ServerList if the # of distinct servers in that list is < 10 ?

 

Labels (3)
0 Karma
1 Solution

PickleRick
Ultra Champion

Since you have a multivalued field, you can do

 

 

<your search> | where mvcount(ServerList)>10

 

 

View solution in original post

PickleRick
Ultra Champion

Ok, but where's the question? What's your problem with that?

And remember that AND is implicit so you don't have to write (condA AND (condB)). Just do condA condB on their own. And avoid wildcard at the beginning of a search term - it will cause splunk to read all the events from given time range to find a match.  Especially if your search term starts at the word boundary - there's no point of adding that wildcard at the beginning. Check for yourself - search for "Starting application:" and "*Starting application:" and compare execution time.

0 Karma

sjringo
Path Finder

Edited to specify what the question is.   Yeah, the search can be optimized, will change that. thanks...

0 Karma

PickleRick
Ultra Champion

Since you have a multivalued field, you can do

 

 

<your search> | where mvcount(ServerList)>10

 

 

sjringo
Path Finder

Was not aware of mvcount(...) 

Thanks for you input and suggestions, its greatly appreciated !

 

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...