I have an index from a forwarder that looks something like this:
"index=indexname DEBUG Rule="Rule One" OR "Rule Two" OR "Rule Three" etc."
I'd like to build a summary of all the Rules that come in via the log that is being read by the forwarder. Something like a top 5 summary of Rules that came out. I've tried to parse through a lookup table, but that didn't do what I wanted. Having difficulty with something that should be pretty easy.
You need to define the rule based on which you want to find the top 5 rules. Example, if you want to find out top 5 Rule based on number of events, you can do like this
index=indexname DEBUG Rule="Rule One" OR Rule="Rule Two" OR Rule="Rule Three"...all rules that you're interested in.. | top 5 Rule
Thanks for the info. A lookup table is what I need, which I had defined, but it wasn't right. However, I still need something else.
okay so I think your question is regarding there are multiple values for a field
step1 :so what you can do is, you can create
mylookup.csv in which you will have column
Rule one two three, etc you need to search
step 2 :add this lookup table using this doc
step 3 :and the write your search query as follows:
index=indexname DEBUG [inputlookup mylookup.csv] | top limit=5 Rule
which means that your search will actually run as
index=indexname DEBUG Rule="Rule One" OR "Rule Two" OR "Rule Three" etc.." | top limit=5 Rule
you can see this search in
job>>inspect job>>saerch job propertise>>normalized search
Let me know if this helps!
Thanks for the help. I did build a lookup table and added it, but still not seeing any results. My lookup looks like this. I thought about quotes around the :
1,Questionable Radio Link
3,Data Abuser Warning
I inspected the job, but I don't see anything glaring except it's not finding anything. But at least this tells me I was on the right track. I'll keep poking.
I am assuming in your logs you have Rule=“bad cable” and so on format right?
If it is then why does your lookup contain 2 columns...
Build a lookup that have only one column just like in splunk ...
In splunk if you have Field name as
Rule and value as
Then your lookup should have only one column i.e
Questionable radio link
Keep column name of csv same as field name in splunk
I hope this helps you!
Yeah, unfortunately, I'd already tried both of your suggestions before I even opened this question and answer. I thought you were on to something with having 2 columns. Hmmm, I know I'm close.
This method is 100 percent working . Just that you need to match fields and value properly .
Yes even i feel this is the better method try and accept the answer which helped to get the work done !
If your lookup has two columns and one of them (column Values) match, exactly, Rule field in your raw data, you can run like this
index=indexname DEBUG [inputlookup mylookup.csv | table Values | rename Values as Rule] | top limit=5 Rule