I'm trying to get a weighted ratio of errors per server. I have a lookup table like this: host,percent server1,25 server2,25 server3,50 Normally I'd do something like sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | chart count by host , which gives me a count of errors by server, but I want a weighted count based on that percent. How would I use the lookup table to multiply the errors on a per server basis? ... View more

Is there a way to use a lookup table to have a list of host, and use that list to only search logs for those hosts? For exmaple, if I have a lookup table like this: host,description server1,Description of server1 server2,Description of server2 server3,Description of server3 Can I run a search that only searches server1/2/3, but would not look at server4/5/6? Basically I'm trying to avoid having to specify host=server1 OR host=server2 OR host=server3 in each search. ... View more

I've got a search that looks something like this: search | eval Minutes=case(field<120,"0 to 2", field>=120 AND field<180, "2 to 3 mins", field>=180 AND field<240, "3 to 4 mins") | chart count as Sent by Minutes. The problem is that the Send field does not always have values, and I am trying to fill those values with 0. Right now they just don't return anything, so if "2 to 3 mins" has a count of 0 it just doesn't show up in the results, like this: .....Minutes .....Sent 1. 0 to 2 mins...503 2. 3 to 4 mins... 20 What I'd like to see is this: .....Minutes ...... Sent 1. 0 to 2 mins ....503 2. 2 to 3 mins .... 0 3. 3 to 4 mins ....20 I've tried adding fillnull, but it doesn't work. ... View more

I'm trying to get the top 10 uri's from our IIS logs, and get the average time taken on each of those. I can't quite figure out how to do it. If I use the top command, when I pipe it to a chart I no longer have the time_taken field. This search works, but it returns all uri's, and I just want the top 10. There's got to be a way to do this. sourcetype=iis | fields time_taken, cs_uri_stem | chart avg(time_taken) by cs_uri_stem ... View more

On one of my universal forwarders I've got an issue where it seems to be ignoring the disabledefaultport setting. I have the following in my server.conf config file: [httpServer] disableDefaultPort = true Despite that setting disabling the port, it is still listening on port 8089. I need to disable this due to vulnerability scans, but for whatever reason it just isn't working. ... View more

I'm trying to group IP address results in CIDR format. Most likely I'll be grouping in /24 ranges. Is there an easy way to do this? Maybe some regex? For example, if I have two IP addresses like 10.10.3.5 and 10.10.3.50 I want them to be counted in the 10.10.3.0/24 range, and then see how many IP's are in each range. ... View more

This may be confusing, so I'll try to explain it as best as I can. I've got a search that looks for servers that get marked down by the load balancer in a 1 minute time frame, and de-duplicates the IP's. I am then alerted if the number of IP's is greater than a certain number. My search is as follows: sourcetype=syslog service down | dedup HostIP This search works great over the realtime 1 minute rolling window. What I'd like to do though is search back historically and see when there were 3 or more unique HostIPs in a 1 minute window. I tried searching with something like this: sourcetype=syslog service down | bucket _time span=1m | stats count by _time And that sort of works, but I can't get the dedup to work for each 1 minute interval, instead it dedup's the entire time range, which isn't what I want. Any ideas? ... View more

We moved to a a couple of new indexers, and set up search head pooling. Now all the alerts we had working before do not send an email. The searches show up and you can run them just fine. Also, new searches/alerts that are configure are working just fine, it's only searches that were configured before we moved everything. ... View more

We recently moved from one indexer to two indexers in a load balancing configuration. Both indexers are also acting as search heads. If I run a search on indexer A, it is able to pull data from indexer B with no problems. I copied the savedsearches.conf to both indexers, as well as the dashboard xml file. Right now we can view the saved searches from either indexer, and run those searches. If I add a new search or dashboard on indexer A, how do I get it to show up in the Searches & Reports section on indexer B? For the life of me I can't figure that out, is it possible? Also, semi-related to this is that all of the alerts that were working on the old indexer are now not working. You can run the search and see that the alerts should be sending an email, but it doesn't do anything. Is there some .conf file I'm missing? Any ideas? ... View more