Stats count query across possible fields from multiple sources?

spark2310 — Mon, 08 Jun 2020 18:11:34 GMT

I am trying to create an alert but some issues with logging that is not standard, so each sourcetype has it's own certain fieldname for error levels (e.g. type), and another certain fieldname for their error message (e.g. msg, or Massage)... in other words, I know the possible field values common across sourcetypes and eventually wanting to timechart or stat to cover all possible fields regardless of data source

This still does not work and if a certain field does not exist, all results will be null. any ideas or a different way to do it?

My query: index=t sourcetype=* (type=error OR T=error OR Level=Critical) (msg=* OR MSG=* OR Message=* OR message=* OR reason=*) |eval MM=msg."".MSGmsg."".Message."".message."".reason|timechart count by MM

Re: Stats count query across possible fields from multiple sources?

richgalloway — Sat, 30 May 2020 12:44:40 GMT

Concatenation will not solve that problem. You want the coalesce function. It chooses the first non-null field from its arguments as its result, which is exactly what you need when some fields are present in some events, but not others.

index=t sourcetype= (type=error OR T=error OR Level=Critical) (msg= OR MSG= OR Message= OR message= OR reason=) 
|eval MM=coalesce(msg,  MSGmsg, Message, message, reason) 
|timechart count by MM

topic Stats count query across possible fields from multiple sources? in Splunk Search

Stats count query across possible fields from multiple sources?

Re: Stats count query across possible fields from multiple sources?