topic Re: How to get the count of the field whose value is greater than 0 ? in Splunk Search

How to get the count of the field whose value is greater than 0 ?

minaljain — Wed, 10 Apr 2019 04:52:24 GMT

I have logs in Splunk which has a field named Message as Highligthed below

I need to extract Manufacture name , total records, processed records and failed records values and get the count of the records and display it in Bar chart

Below is the query which i tried to generate the result

index ="XYZ" "Failed Records" "Manufacture:Actia" |rex field=_raw "Total Records:(?\d+);Processed Records:(?\d+);Failed Records:(?\d+)" | timechart count(total) as Total, count(processed) as processed,count(failed) as Failed

i need to get the count for the records
Total Records :20
Processed records : 18
Failed Records: 2

Please suggest.

Re: How to get the count of the field whose value is greater than 0 ?

diogofgm — Wed, 10 Apr 2019 10:12:42 GMT

if the info in the message is a result a running process and you want to get the latest status you can use latest(*) instead of count. e.g. | timechart latest(total) as Total latest(processed) as processed latest(failed) as Failed
Count doesn't seam to make much sense to me in that context, but I might by assuming something wrong. Can you give more details about the context that log is generated?

Re: How to get the count of the field whose value is greater than 0 ?

to4kawa — Sun, 19 Jan 2020 11:34:58 GMT

| makeresults
| eval _raw="Date = 2019-04-09 11:43:20,946 | Level = INFO | RequestID = | ErrorCode = | ErrorMessage = Records details | Alert = false | Message = Manufacture:Actia;Total Records:20;Processed Records:18;Failed Records:2"
| extract pairdelim="|;" kvdelim="=:"
| eval _time=strptime(replace(Date,",","."),"%F %T.%3Q")

Hi, folks.
For structured logs, try extract.
Regex-free.

Re: How to get the count of the field whose value is greater than 0 ?

woodcock — Sun, 19 Jan 2020 22:21:27 GMT

Step 1: get your field extractions straight globally for this sourcetype (so you don't need to do the rex). Try this:

index ="XYZ" AND sourcetype="SomeSourcetypeHere" AND "Failed Records" AND "Manufacture:Actia"
| rex "Total Records:\s*(?<TotalRecords>\d+);\s*Processed Records:\s*(?<ProcessedRecords>\d+);\s*Failed Records:\s*(?<FailedRecords>\d+)"
| timechart count AS EventCount, sum(TotalRecords) AS Total, sum(ProcessedRecords) AS Processed, sum(FailedRecords) AS Failed

Possibly, depending on how your events are generated (what they mean), you might need max instead of sum.