Splunk Search
Highlighted

how to show data with 2 different fields

Communicator

Hi,

I have two types of parameters in my logs i.e. "Batch received successfully" and "could not be found" now i want to make dashboard with the help of these logs in which it will show data for hosts with these parameters like it will show that how many logs are coming on hourly basis with these parameters. There are two hosts from where the data coming so I have made query but not showing the proper output which I want.

index="sc-kofax" sourcetype="sc-kofax-sv-acis" "Batch received successfully" OR "could not be found" | Stats count by host

Thanks
Ankit

Tags (2)
0 Karma
Highlighted

Re: how to show data with 2 different fields

Builder

Hi,

Use Field extractor for extracting different fields for "Batch received successfully" & "could not be found" (http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX), use these fields in query.

Lets say, "Batch received successfully"=SUCCESS and "could not be found" = FAILURE, then the query will look like:

index="sc-kofax" sourcetype="sc-kofax-sv-acis" SUCCESS=*  OR FAILURE=* | Stats count by host

Thanks!!

0 Karma
Highlighted

Re: how to show data with 2 different fields

Communicator

Thanks for answering but Given link is not working.

0 Karma
Highlighted

Re: how to show data with 2 different fields

Communicator
0 Karma
Highlighted

Re: how to show data with 2 different fields

Motivator

try like :

index="sc-kofax" sourcetype="sc-kofax-sv-acis"  | Stats count(eval("Batch received successfully")) as "count of Batch received successfully" count(eval("could not be found")) as "count of could not be found" by host

View solution in original post

Highlighted

Re: how to show data with 2 different fields

Communicator

Hey .. thanks once again.. you solved my problem..

0 Karma