Grouping by a substring

R0ss — Mon, 19 Jun 2017 09:04:59 GMT

Hello,

I'm having trouble grouping errors in our Splunk logs. The date and time is appended to the error messages, meaning that every message is unique. For example:

Message=2017-06-19 09:15:23,825 ERROR - Here is the error message that we would like to group on...

I would like to ignore the date/time string and group on the text that appears after this. The best I have come up with is as follows:

Type=Error | eval ErrorString=substr(Message,30,len(Message)) | stats count by ErrorString

But this search still seems to evaluate as if the date is present in the new ErrorString string (the count is always 1 and ErrorString's are duplicated across rows)

Could you help me to write a query that would group the error messages and ignore the date/time.

Thanks,
Ross

Re: Grouping by a substring

dineshraj9 — Mon, 19 Jun 2017 11:43:31 GMT

You can extract the string at the end and use it in the grouping -

<your search> | rex field=Message "(?<ErrorString>ERROR.+)"  | stats count by ErrorString

Re: Grouping by a substring

R0ss — Mon, 19 Jun 2017 12:50:42 GMT

Perfect, thank you!

topic Re: Grouping by a substring in Splunk Search

Grouping by a substring

Re: Grouping by a substring

Re: Grouping by a substring