×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ilyashussain
Engager
Member since: ‎03-14-2014
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎03-14-2014
Activity Feed
View All

Alert based on number of events after charting the...

by in Alerting
‎07-18-2014 05:08 PM
‎07-18-2014 05:08 PM
I am a newbie on Splunk and have been trying to create an alert using the following search: index=prodenvs source=prodlogs "transaction timeout" I had setup it to cron every 5 mins and check past 5 mins and alert if the count goes more than 10. The alert was working fine but I wanted to summarize the results based on hosts. index=prodenvs source=prodlogs "transaction timeout" | chart count by host The alert stopped working after I changed it and I noticed that the alert criteria is taking number of hosts as the "count" now. Can I still use the alert feature based on the number of events and yet be able to chart my results? Any help is greatly appreciated. ... View more

Re: Aggregated reporting on a field with variable ...

by in All Apps and Add-ons
‎03-17-2014 02:44 PM
‎03-17-2014 02:44 PM
Awesome. Thank you for the quick response. Much appreciated. Unfortunately, the events are logged by a legacy program and we have very little control on how and what is being logged can this be modify to make it look like below (where h=current hour)? I tried stats count by prg, date_hour but it inserts one row per hour per prg. PRGName   h-2   h-1   h PRGNM1    35   23   76 PRGNM2    43   53   12 ... View more

Aggregated reporting on a field with variable valu...

by in All Apps and Add-ons
‎03-14-2014 05:40 PM
‎03-14-2014 05:40 PM
Hi, I am trying to create a scheduled report that will count the number of events for specific keywords. The event entry looks somewhat like: 10 Mar 2013 10:10:35,559 MyApplicationProcessor : MyProcess PIDNo [123456] MyProcessGroup [PRG_NM1] FailureRetryCount[x] ExceptionRetryCount [y] Finishing Process 10 Mar 2013 10:10:35,123 MyApplicationProcessor : MyProcess PIDNo [123456] MyProcessGroup [PRG_NM2] FailureRetryCount[x] ExceptionRetryCount [y] Finishing Process 10 Mar 2013 10:10:35,234 MyApplicationProcessor : MyProcess PIDNo [123454] MyProcessGroup [PRG_NM1] FailureRetryCount[x] ExceptionRetryCount [y] Exit 10 Mar 2013 10:10:35,234 MyApplicationProcessor : MyProcess PIDNo [123454] MyProcessGroup [PRG_NM1] FailureRetryCount[x] ExceptionRetryCount [y] Finishing Process 10 Mar 2013 10:10:35,234 MyApplicationProcessor : MyProcess PIDNo [123454] MyProcessGroup [PRG_NM1] FailureRetryCount[x] ExceptionRetryCount [y] Enter The PIDNo,x,y, PRG_NM etc are variables I am particularly looking to create a report based on PRD_NM where the even ends with Finishing Process. The PRG_NM can be any of the 100+ possible values. The reports needs to look like: PRG_NM1 - 35 PRG_NM2 - 43 PRG_NM3 - 21 PRG_NM4 - 42 Any help is greatly appreciated. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All