Here a bunch of queries I’ve been working recently. Hope it helps!

close up code coding computer
Photo by Lorenzo Cafaro on Pexels.com

SEARCH FOR NOT FOUND WEB PAGES

Perform the following query:

404 and 'Log Source' like '%access%' 

SEARCH REQUEST THAT RETRIEVE A PAYLOAD BIGER THAN A SIZE AND ORDER THEM BY SIZE DESCENDING

'Content Size' > 0 | eval MB = 'Content Size' / (1024 * 1024) | where MB > X | sort -MB

Where X is the size in MB, for example:

'Content Size' > 0 | eval MB = 'Content Size' / (1024 * 1024) | where MB > 5 | sort -MB

DETECT IF MORE THAN ONE LOG SOURCE IS LOADING THE SAME LOG RECORDS

My colleague created a new log source for OSB access logs with a pattern that was already configured in the WLS Server log source. In the osa access log source he included a data filter but all the records appeared in searches. My guess was that the records were processed by the 2 log sources… With this query I found that record were coming from the 2 sources:

<unique expression you have checked is only in one log file>  | distinct 'Log Source'
'/pedi2/img/u173.png' | distinct 'Log Source'

REJECT ALL RECORDS EXCEPT THOSE CONTAINING “or /AAA/ or /BBB/ or /CCC/ or /DDD/”

SOLUTION: Create a data filter with an expression like:

^(?!.*(\/AAA\/|\/BBB\/|\/CCC\/|\/DDD\/)).*

Example:

^(?!.*(\/pedis\/|\/regus\/|\/pedi2\/|\/regis\/)).*

 

SEARCH FOR A PHRASE

Enclose it in ” or “”. Example:

'MANAGERS PedidoManagerMov' and 'Log Source' = 'MDONA WEBAPP Logs' | cluster 
analytics text
Photo by Timur Saglambilek on Pexels.com

Enjoy 😉

Comments

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.