Splunk Search

how to find all windows systems reporting a partcular event ID, Source, and/or Severity

Justin_Grant
Contributor

What are the searches required to search across Windows Event Logs for:

  • most recent events of a particular event ID and Source
  • count of events of a particular event ID, per day for the past month
  • all systems reporting a particular event ID and Source
  • the most recent events of "error" severity across all my monitored systems

I realize this is an easy question, but it's one I heard from a Splunk user today and it didn't already have an entry in Answers...

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

This is really a basic search language issue, and might be better addressed in the http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchCheatsheet or elsewhere in http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/WhatsInThisManual

Nevertheless:

  • sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | head 5
  • sourcetype=WinEventLog:* EventCode=$myeventcode$ earliest=-1mon | timechart span=1d count
  • sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | top limit=0 host
  • Severity=Error | dedup 1 host

The base search terms can of course be changed to suit the right WinEventLog, EventCode, Source, Severity, or other criteria. I'm pretty sure Severity isn't a field name, but I can't remember the right one.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

This is really a basic search language issue, and might be better addressed in the http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchCheatsheet or elsewhere in http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/WhatsInThisManual

Nevertheless:

  • sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | head 5
  • sourcetype=WinEventLog:* EventCode=$myeventcode$ earliest=-1mon | timechart span=1d count
  • sourcetype=WinEventLog:* EventCode=$myeventcode$ Source=$mysource$ | top limit=0 host
  • Severity=Error | dedup 1 host

The base search terms can of course be changed to suit the right WinEventLog, EventCode, Source, Severity, or other criteria. I'm pretty sure Severity isn't a field name, but I can't remember the right one.

View solution in original post