Splunk Search

how to show data with 2 different fields

sunnyparmar
Communicator

Hi,

I have two types of parameters in my logs i.e. "Batch received successfully" and "could not be found" now i want to make dashboard with the help of these logs in which it will show data for hosts with these parameters like it will show that how many logs are coming on hourly basis with these parameters. There are two hosts from where the data coming so I have made query but not showing the proper output which I want.

index="sc-kofax" sourcetype="sc-kofax-sv-acis" "Batch received successfully" OR "could not be found" | Stats count by host

Thanks
Ankit

Tags (2)
0 Karma
1 Solution

fdi01
Motivator

try like :

index="sc-kofax" sourcetype="sc-kofax-sv-acis"  | Stats count(eval("Batch received successfully")) as "count of Batch received successfully" count(eval("could not be found")) as "count of could not be found" by host

View solution in original post

fdi01
Motivator

try like :

index="sc-kofax" sourcetype="sc-kofax-sv-acis"  | Stats count(eval("Batch received successfully")) as "count of Batch received successfully" count(eval("could not be found")) as "count of could not be found" by host

sunnyparmar
Communicator

Hey .. thanks once again.. you solved my problem..

0 Karma

vganjare
Builder

Hi,

Use Field extractor for extracting different fields for "Batch received successfully" & "could not be found" (http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX), use these fields in query.

Lets say, "Batch received successfully"=SUCCESS and "could not be found" = FAILURE, then the query will look like:

index="sc-kofax" sourcetype="sc-kofax-sv-acis" SUCCESS=*  OR FAILURE=* | Stats count by host

Thanks!!

0 Karma

sunnyparmar
Communicator

Thanks for answering but Given link is not working.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...