topic Re: Searchmatch in Dashboards & Visualizations

Searchmatch

suvi6789 — Wed, 07 Aug 2024 10:12:28 GMT

Hi,
I have doing a list of different searches and want the count of each searches.
So, I was using the searchmatch command but when using it I get only the first result that is successfully searches and it ignore the rest

For example:

index="abc"
| eval JobName= case(
searchmatch("error 1234", Error1),
searchmatch("error 567", Error2),
searchmatch("error 89", Error3)
)
| stats count by JobName

Output says
Error1 - 234 (234 is the count of error)

though error 2 and error 3 are there, It is not listing in the results.
Please could you suggest on how to get this sorted

Re: Searchmatch

gcusello — Wed, 07 Aug 2024 10:40:10 GMT

Hi @suvi6789 ,

parenthesis are wrong and if Error1,2 and3 are strings, use quotes:

index="abc" | eval JobName= case( searchmatch("error 1234"), "Error1", searchmatch("error 567"), "Error2", searchmatch("error 89"), "Error3" ) | stats count by JobName

Re: Searchmatch

suvi6789 — Wed, 07 Aug 2024 10:43:52 GMT

Thanks for the response
My Bad, the parenthesis are wrong. I have ran the query with the right paranthesis. It was a typo.

index="abc"
| eval JobName= case(
searchmatch("error 1234"), "Error1",
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)
| stats count by JobName

Output says
Error1 - 234 (234 is the count of error)

though error 2 and error 3 are there, It is not listing in the results.

Re: Searchmatch

gcusello — Wed, 07 Aug 2024 10:46:56 GMT

Hi @suvi6789 ,

the search is correct, are you sure about the strings to search for Error 2 and 3?

Only for debugging, please change the order of searchmatch in the eval.

Ciao.

Giuseppe

Re: Searchmatch

suvi6789 — Wed, 07 Aug 2024 10:48:27 GMT

If I comment
index="abc"
| eval JobName= case(
```searchmatch("error 1234"), "Error1",```
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)

Now, the result is
Error2 - 125

Re: Searchmatch

suvi6789 — Wed, 07 Aug 2024 10:52:12 GMT

Thank you for your response

If I comment the first search
index="abc"
| eval JobName= case(
```searchmatch("error 1234"), "Error1",```
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)

Now, the result is
Error2 - 125

Re: Searchmatch

gcusello — Wed, 07 Aug 2024 10:52:53 GMT

Hi @suvi6789 ,

Only for test, please try this:

index="abc" | stats count(eval(searchmatch("error 1234"))) AS "Error1" count(eval(searchmatch("error 567"))) AS "Error12" count(eval(searchmatch("error 89"))) AS "Error3"

the issue is probably on the data, you must analyze them

Ciao.

Giuseppe

Re: Searchmatch

PickleRick — Wed, 07 Aug 2024 12:34:03 GMT

That's how case works - it returns the value for the first matching condition. If you want to evaluate all conditions, you have to do three separate evals and assign values to three separate fields.