Hello, I want to alter the radial gauge (default is 100). We expect about 5,000 log entries/lines per hour and I am curious how we can change the Radial Gauge threshold/value. Also, how can we revert the direction? I.e.: 5,000 entries is in the green and 0 would be red (because we expect a large count = good/green). Thanks! ... View more

This successfully colors results accordingly: index=myindex host=app01 source="C:\\Log1.txt" | rex "RecordsProcessedCount to (?<ProcessCount>\d+)" | stats max(ProcessCount) as ProcessCount | rangemap field=ProcessCount low=4000-91128 severe=0-3999 This does not color results: index=myindex host=app02 source="C:\\Log2.txt" | stats count as value | rangemap field=value low=0-500 severe=501-10000 They both bring back a single numeric result (one is based on a regex value and the other is simply a line count). Why would it work with the first search, but not the other (first is colored green, but the other defaults to black)? Thanks! ... View more

We have a search that comes back with the following raw log data in every few lines: getUnitofWorkThread-1 incrementing totalRecordsProcessedCount to 85441 That number increments and I want to display the latest number with the search range (i.e.: If I have 20 values (number increments), I only need the latest/largest number). How do I do this? I'm open to any suggestions. Should I shorten the range to the last 1 minute? Real-time searches cause unnecessary load on the search head, so I was hoping to do perhaps the last 5 minutes and perform the search every 5 minutes. Additionally, I want to create a dial/gauge that shows x number of log entries (realtime search is ok in this case) for past x seconds/minutes. So any suggestions on how to create that would be appreciated. The goal is to ensure that we don't have any delays in processing a job that will take about 48 hours. If there is a hang and the output to log slows down dramatically, or even stops, we want an alert. But first I wanted to get a handy dashboard going. Thanks! ... View more

Hello, I have a search that provides the results I need, and now I need to use these results (windows services) as arguments in a powershell script (using the "Run a Script" section when creating an Alert. I was hoping to pass something like this, in that "Run a script" field: c:\StartServices.ps1 "host" "servicename" As you can see, I'm using the host & servicename fields to pass as arguments to the powershell script. But the question is: can I do this? If so, am I doing this correctly, or is there a different way to do this? Thanks! ... View more

Hello, The following search: index=app_win source=service State=Stopped StartMode (Auto OR Manual) Name=*IBM* OR Description=*IBM* OR DisplayName=*IBM* | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name" does not show some events. Here is an example of one that shows up just fine: Type=Service Name="IBMWAS70Service - TOS_Server_Server01" DisplayName="IBM WebSphere Application Server V7.0 - TOS_Server_Server01" Description="Controls the running of an IBM WebSphere Application Server V7.0 server named: TOS_Server_Server01" Path=""C:\vol\data\IBM\WebSphere\AppServer-V70\bin\wasservice.exe" "IBMWAS70Service - TOS_Server_Server01"" ServiceType="Own Process" StartMode="Manual" Started=false State="Stopped" Status="OK" ProcessId=0 host = server01 source = service sourcetype = WinHostMon Here is an example of one that does NOT show up in the | stats output: Type=Service Name="MailService" DisplayName="IBM Rational ClearQuest Mail Service" Description= Path=""C:\Program Files (x86)\IBM\RationalSDLC\ClearQuest\mailservice.exe"" ServiceType="Own Process" StartMode="Auto" Started=false State="Stopped" Status="OK" ProcessId=0 host = server02 source = service sourcetype = WinHostMon Any ideas? Perhaps something to do with the description being blank? Why would that matter (especially when using an OR operator)? Thanks! ... View more

Hello, Here is my search: index=app_win source=service State=Stopped StartMode (Auto OR Manual) Name (*IBM* OR *CollabNet* OR *SVN* OR *Kofax* OR *QAS* OR *FLEXLm*) OR Description (*IBM* OR *CollabNet* OR *SVN* OR *Kofax* OR *QAS* OR *FLEXLm*) OR DisplayName (*IBM* OR *CollabNet* OR *SVN* OR *Kofax* OR *QAS* OR *FLEXLm*) NOT (Description=*Collec* OR *EnvAdmin*) | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name" Most of the results show up in my table output, but some of the results do not (FTR... ALL results DO show up in the raw search results, so we are 100% sure it is picking up that data. It simply doesn't want to graph it as part of the 'chart' output). Any ideas why? Example of the raw data of one that does NOT show: Type=Service Name="MailService" DisplayName="IBM Rational ClearQuest Mail Service" Description= Path=""C:\Program Files (x86)\IBM\RationalSDLC\ClearQuest\mailservice.exe"" ServiceType="Own Process" StartMode="Auto" Started=false State="Stopped" Status="OK" ProcessId=0 Collapse host = source = service sourcetype = WinHostMon Example of one that DOES show: Type=Service Name="IBMWAS70Service - ContentEngine" DisplayName="IBM WebSphere Application Server V7.0 - ContentEngine" Description="Controls the running of an IBM WebSphere Application Server V7.0 server named: FileNet_Server_1_CE-" Path=""C:\IBM\WebSphere\AppServer\bin\wasservice.exe" "IBMWAS70Service - ContentEngine"" ServiceType="Own Process" StartMode="Manual" Started=false State="Stopped" Status="OK" ProcessId=0 Collapse host = source = service sourcetype = WinHostMon Thanks! ... View more

Hello you syntax gurus! This should be simple, but haven't done this yet. 😉 I just want to cleanup some of the 'OR' and provide a list instead within parenthesis (I think it's the way it works). Can you provide a cleaned up example that will search the exactly the same? index=app_win source=service State=Stopped StartMode=Manual OR StartMode=Auto Name=IBM OR Name=CollabNet OR Name=SVN OR Name=Kofax OR Name=QAS OR Name=FLEXLm Description=IBM OR Description=CollabNet OR Description=SVN OR Description=Kofax OR Description=QAS OR Description=FLEXLm | stats count by Name StartMode host Description | rename Name as "Service Name" Thanks! ... View more

Here is my search: index=windows source="WMI:Services" State=Stopped StartMode=Auto | rex field=_raw "\nName=(?PIBM.{1,})" | chart count by SvcName | rename SvcName as "Service Name" And I need to add another column to the right of the "Service Name" column called "Host". This way I have the windows service name associated with the host that I'm looking for. How do I adjust my search string to add this column to the statistics table view? Thanks! ... View more