I would like to create a report that counts the number of times I see an error log in one file with a count of events I see from another source as a percentage over time. source="/var/log/messages" "Specific Error message" | stats count by time and source="/var/log/httpd/*access_log" uri_path=/function/function* |transam clientip maxspan=60m | stats count by time Basically, it is acceptable to get a number of the errors. I would like to chart the number of errors in the first search against the number of unique ip's that are using this function as a ratio and alert if it gets too high. ... View more

I'm having a bit of trouble finishing up a report I'm trying to give a report of how long users were logged into a system over the course of a day. Sometimes a user logs in multiple times. I want to have a stacked chart showing each time a user logged in added together. I have: source="*usermonitor*.log" "usermanager reports user * logged" | rex "usermanager reports user (?P<USER>[^\.]*) logged " |search USER="*" | transaction USER startswith="logged in, reply " endswith="logged out, reply " | eval Hours=round(duration/3600,2) |chart values(Hours) by USER The results show exactly what I want. A list like: User1 2.5 User2 3.1 User3 2.8 1.5 User4 7.4 etc. Now when I "Show Report", I only see values on the chart for Users with only 1 entry and I can't make it a "Stacked" chart to total them all. Of course, doing a " |chart sum(Hours) by USER " gives me the correct totals for all of the users, but I lose the individual values. Any Suggestions? ... View more

I have application logs that will create a log when a user makes a request like: 2010-02-17 16:13:28.515 host1:1111:application DBG User made a requst[99999-1]: FOO (12345) It then creates another log when the request is acknowledged like: 2010-02-17 16:13:29.118 host1:1111:application DBG reply for user 12345: request acknowledged I am able to do a search and group both logs into pairs with transaction: host="host1" source="C:\\logs\app*" ("DBG User made a request" OR "request acknowledged") | rex "DBG User made a requst: Foo \((?<ID>\d+)\) \[" | rex "DBG reply for user (?<ID>\d+): " | transaction ID maxspan=60s startswith="DBG User made a request" endswith="request acknowledged" and I get a nice list of all the request/acknowledge pairs grouped together. What I need is to find (and alert) when I get a request, but not a matching acknowledge. Any ideas? ... View more