Hi we have a microservices based system and have several services running , the developers put unti a lookup table the complete search string, . I am ablr to retrieve the string from lookup but not able to execute it | inputlookup searchstring.csv | streamstats count as Rowcount | where Rowcount =1 | search Search_String   a sample of what is there in Search_String , this one is simple but sometimes there are complex queries   index=abc* AND source= xyz* AND host=* AND ERROR=50* | stats count as 5xx_Errors     how to make the Search string in lookup execute ... View more

I have a question, in microservice based platform where are getting several logs for the different application. Each application tracks unique transactions via a id, either a CorrelationId, SessionId, transactionid I want to be able to put this is a lookup application.csv file and use it for same dashboard so my lookup will look like Application SourceLogs Unique_Identifier App1 Application1.logs CorrelationId App2 Application2.logs SessionId App3 Application3.logs TransactionId I have created a input where the user can select the Application via tkn_app index=application_logs | lookup application.csv SourceLogs as source | search Application=$tkn_app$ | bin span=5m _time | stats dc(Unique_Identifier) AS TPS by _time however this searches for Correlationid , SessionId and TransactionId and not the actual values, how to I make it so Unique_Identfier searches for the right metadata   Note the logs are in json format, so the fields Correlationid , SessionId and TransactionId are autodetected by Splunk ... View more

There are some liberty services and in some host we have many microservice , I want to monitor CPU / memory usage in the particular host , is there a splunk query that will help me get this ... View more

I am trying to create a timechart of errors with but is not working  index=xxx  AND source = xxxx AND (Error* OR Exception*) | timechart distinct_count(txnid) as errCount | eval RAG = case ( errCount > 200, “Red”,  errCount > 100 AND errCount <=200, “Amber” , 1==1,  “ Green”) <option name=“charting.fieldcolors”>{“Red”: 0xD93F3C, “Amber”: 0xFF9933, “Green”: 0x009933}</option> ... View more