Handle different search results as one by analysing the percentage match

mmsbswe — Tue, 13 Aug 2019 08:47:32 GMT

Hi Community,

i have a search which shows me all PHP-Errors in the configured timespan. Now i want so sort this results by matching diffs other results in percent and show results over X% matching results as one.

For instance:

Search Query:

index=php source="/var/log/docker/php-fpm/error.log" "PHP Fatal error"

Example result 1:

[13-Aug-2019 03:01:29 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
/usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfiguration.php(10): require_once()

Example result 2:

[12-Aug-2019 17:01:01 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:12
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/EnvironmentPilot.php(41): include()

Field extractions are very useful but the most php-fpm-errors are very different in their appearance.

Now i want a output like this instead of two results :

PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
....

Thanks in advance for checking my question!

Re: Handle different search results as one by analysing the percentage match

Sukisen1981 — Tue, 13 Aug 2019 10:46:52 GMT

so you extract using a rgeex from PHP Fatal error: Uncaught Error: to end of line or to just before Stack trace: is encountered in the log.
Then you look at how many distinct such extractions you get and calculate percentages based on the counts.
Is this what you are looking for?

Re: Handle different search results as one by analysing the percentage match

mmsbswe — Wed, 14 Aug 2019 08:37:55 GMT

Hi, i will try it. Thanks!

topic Handle different search results as one by analysing the percentage match in Splunk Search

Handle different search results as one by analysing the percentage match

Re: Handle different search results as one by analysing the percentage match

Re: Handle different search results as one by analysing the percentage match