Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About jdibble
jdibble
Explorer
Member since:
06-21-2011
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 06-21-2011 |
Activity Feed
- Got Karma for Alert based on total for only some rows. 06-05-2020 12:45 AM
- Posted Re: Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-26-2012 11:41 AM
- Posted Re: Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-26-2012 11:41 AM
- Posted Re: Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-25-2012 06:05 AM
- Posted Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-23-2012 11:50 AM
- Tagged Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-23-2012 11:50 AM
- Tagged Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-23-2012 11:50 AM
- Tagged Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-23-2012 11:50 AM
- Tagged Search not coming upwith results for new hosts for non-admins on Getting Data In. 01-23-2012 11:50 AM
- Posted Re: Alert based on total for only some rows on Alerting. 06-27-2011 11:14 AM
- Posted Re: Alert based on total for only some rows on Alerting. 06-24-2011 11:44 AM
- Posted Alert based on total for only some rows on Alerting. 06-21-2011 07:30 AM
- Tagged Alert based on total for only some rows on Alerting. 06-21-2011 07:30 AM
- Tagged Alert based on total for only some rows on Alerting. 06-21-2011 07:30 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 1 |
01-26-2012
11:41 AM
How would I go about checking the second one?
... View more
01-26-2012
11:41 AM
In regards to your update, as I said before I had tried removing my additional user roles so that my user only has the admin user role. (which the actual admin user has)
... View more
01-25-2012
06:05 AM
I tried that and found that my user does have the admin user role. I had a couple of other user roles as well and tried removing them, logging out and back in, and searching again but the results are the same.
... View more
01-23-2012
11:50 AM
We've recently changed out our servers and when I use the searches against these new hosts using my user I am not getting the log results like I was with the old servers. We are definitely getting the log data but my user just can't access it. However, the admin user is getting the results. Furthermore any searches that are owned by my user do not get the results when they send out scheduled e-mail alerts, but the ones owned by the admin user do get results.
Is there a setting somewhere for these new hosts that I need to change?
... View more
06-27-2011
11:14 AM
Aside from the solution nick posted, I came up with an alternative. (it also includes all 400 and 500 errors, not just 404 and 500) Here's the base search:
sourcetype="iis" | stats count by sc_status | eventstats sum(count) as total | eval percent = round(100*(count/total),2) . " %" | search (sc_status=4* OR sc_status=5*) | eventstats sum(count) as errortotal | eval errper = round(100*(errortotal/total),2) | fields - errortotal, total
With an alert condition of
search errper > 1
This filters it down to just the errors, and the only problem I have with it is that it keeps a column I don't want to display (errper) because removing it from the fields causes the alert not to fire. Still, it does what I need it to do so I can work on finding a way to hide that one column later.
... View more
06-24-2011
11:44 AM
Thanks for the answer, but I need to do it with the stats command if it's at all possible.
... View more
06-21-2011
07:30 AM
1 Karma
I have a search set up to display HTTP status results with totals and percentage of the total events.
sourcetype="iis" | stats count by sc_status | eventstats sum(count) as total | eval percent = round(100*(count/total),2) . " %" | fields - total
I need to set up an alert for this search based on the results of only some of the columns using a custom condition. I would like to send an alert only if the percentage of the total results is greater than 1% for the combined 404 and 500 errors. I need to know what custom condition search would enable me to do this.
... View more
