how to show data with 2 different fields

[sunnyparmar]

Hi,

I have two types of parameters in my logs i.e. "Batch received successfully" and "could not be found" now i want to make dashboard with the help of these logs in which it will show data for hosts with these parameters like it will show that how many logs are coming on hourly basis with these parameters. There are two hosts from where the data coming so I have made query but not showing the proper output which I want.

index="sc-kofax" sourcetype="sc-kofax-sv-acis" "Batch received successfully" OR "could not be found" | Stats count by host

Thanks
Ankit

[fdi01 · Accepted solution]

try like :

index="sc-kofax" sourcetype="sc-kofax-sv-acis"  | Stats count(eval("Batch received successfully")) as "count of Batch received successfully" count(eval("could not be found")) as "count of could not be found" by host

[sunnyparmar]

Hey .. thanks once again.. you solved my problem..

[vganjare]

Hi,

Use Field extractor for extracting different fields for "Batch received successfully" & "could not be found" (http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX), use these fields in query.

Lets say, "Batch received successfully"=SUCCESS and "could not be found" = FAILURE, then the query will look like:

index="sc-kofax" sourcetype="sc-kofax-sv-acis" SUCCESS=*  OR FAILURE=* | Stats count by host

Thanks!!

[sunnyparmar]

Thanks for answering but Given link is not working.

[alekksi]

http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX