×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Ganesh1
Engager
Member since: ‎12-08-2023
‎03-26-2024
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎12-08-2023
View All

Re: Returning incorrect count from Splunk stats c...

by SplunkTrust in Alerting
‎03-26-2024 07:27 AM
‎03-26-2024 07:27 AM
Hi @Ganesh1 , If the events are less than the total count in stats ,check i the fields Object and Failure_Message are present in all the events or only in a subset of them, and eventually not both in the same events. If the events are freater than the total count in stats, probably you have more values in the same events. because probably the issue is related to the fact that a stats count BY two fields returns the count of results with both the fields containing a value. Ciao. Giuseppe ... View more

Re: Alert notification whenever any server(s) log ...

by SplunkTrust in Alerting
‎12-08-2023 11:01 PM
1 Karma
‎12-08-2023 11:01 PM
1 Karma
Hi @Ganesh1 , there are many solution to this request in Community, you have to create a lookup (called e.g. perimeter.csv) containing the 40 hosts to monitor (at least one column "host") and then run every hour something like this: | tstats count WHERE index=* BY host | append [ | inputlookup perimeter.csv | eval count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0  Ciao. Giuseppe ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎03-26-2024 10:45 AM