About batham

smurf · ‎08-08-2023

Hi, I was dealt with a similar scenario. I would use a lookup to get a list of servers. I would also add the threshold to the lookup (host, threshold) to future-proof it. Then you can append the list and do some dudup/stats magic; or start with inputlookup and join your search. smurf

ITWhisperer · ‎05-11-2023

Assuming you have already extracted the fields, try this | chart count by dare name

batham · ‎01-30-2023

Figured out the solution.

batham · ‎01-30-2023

Inner join actually worked for this.

ITWhisperer · ‎01-27-2023

_time is usually already in epoch format (it is just displayed in local format). %Y is for 4-digit years i.e. including the century. %y is for 2-digit years i.e. without the century.

richgalloway · ‎12-13-2022

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

bowesmana · ‎12-11-2022

Use rex to extract the server name from the source, i.e. | rex field=source ".*LOG-(?<server>.*)" That will give you a new field name called 'server' - note it captures everything in the source field following LOG- Then you can do whatever you want with that new field.

Posts	10
Solutions	3
Karma Given	3
Karma Received	0
Member Since	‎12-11-2022

Online Status	Offline
Date Last Visited	‎08-08-2023 06:02 PM

How to create alert on if log message does not app...

How can I get stats based on unique Id?

How to inner join with field subtraction on two fi...

Combine 2 or more strings based on a comman field

Why won't strptime work for the below format?

How to search and sort based on dynamic value?

How to get dynamic source name from a request?

Re: Creating alert on if log message does not appe...

Re: Stats based on unique Id

Re: InnerJoin with field subtraction on 2 fields p...

Re: Combine 2 or more strings based on a comman fi...

Re: Strptime not working for the time

Re: Search and sort based on dynamic value

Re: how to get dynamic source name from a request?

Are you a member of the Splunk Community?