query for the count basedo the server

[kteng2024]

Hi,

Below is the sample logs and I want to see the how many events generated from each server. Since there are different servers with different format , field extractions is not working . Can I please know how to write a query to display events generated by each server.

(highlighted are the server names)

2016-11-15 13:35,123124e3,ADA,22361,jobtype event Jun 08 17:23:53 EDT 2017,admin,COMPLETED,2017-11-15 00:00:00.000,2017-11-15 00:00:00.000,2017-11-15 00:00:59.372,2017-11-15 00:00:59.564,apache34,,0,P3,

2016-11-15 13:35,123124e3,ADA,22361,jobtype event Jun 08 17:23:53 EDT 2017,admin,COMPLETED,2017-11-15 00:00:00.000,2017-11-15 00:00:00.000,2017-11-15 00:00:59.372,2017-11-15 00:00:59.564,ab-12312312.xy12.absv.api.comm,,0,P3,

[rphillips_splk]

since your events are comma delimited you could use Splunk's search time field extractor in the GUI to extract all of the fields and name them what you like. For example if you are using server as a field name you would then have a search that looks like:

index=x sourcetype=y | stats count by server

In most cases the host field in the event is what you would use unless you've got another scenario where the host field is another host such as your HF or syslog receiver

[rphillips_splk]

to access the built in field extractor in the GUI:
search for those events and then in the event you will see the Event Actions pulldown > Extract Fields

[kteng2024]

thank you for the reply.. but extracting the server is difficult as servers doesn't have constant name.

[cpetterborg]

Without extracting the hostname field that you want, you cannot do what you want. You can't count something that you can't distinguish. If all you can see is that they are animals, then you can't count the number of birds, because you can't tell a bird from an elephant.

It should be possible to extract the hostname into a field even if there are different formats. Since the events that you supplied were of the same format, please provide a few examples of the different formats, and perhaps we can help you get the file extraction working.