topic Search query result from two log statements. in Splunk Search

Search query result from two log statements.

mahenderj — Wed, 30 Sep 2020 02:45:00 GMT

Hi,

I wanted to search result as count from two log statements.
one log statement has value "...Out of stock ..."
and another log statement has "DF Suppressed"
I wanted to get count of these two for transaction for past 10 days. Each log statement prints with a transactionId.

This is the one I have for only one item
index=idp_* "DF Suppressed" | dedup x_TraceId | stats count as DF_Supress_count | where DF_Supress_count>0

But I want to include "Out of stock" to the query

Re: Search query result from two log statements.

wmyersas — Thu, 24 Oct 2019 22:14:11 GMT

Maybe something like this:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

Add additional filtering later - for example:

| where dfsCount>0 AND oosCount>0

...or whatever else you might like.

This will create two new fields - dfsuppressed and outofstock - which will either have the text you're looking for in them, or be null.

Re: Search query result from two log statements.

mahenderj — Fri, 25 Oct 2019 03:47:08 GMT

Thanks for your answer.
Your search criteria ran without any errors but I see only Out of Stock(oosCount ) counts and 0 count for dfsCount.

Re: Search query result from two log statements.

wmyersas — Wed, 30 Oct 2019 21:52:15 GMT

Add a |fillnull between the second | rex line and the | stats thusly:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| fillnull
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

You may have events where one or the other of the rex lines isn't pulling an actual value, so it's getting null. Adding a | fillnull will put the value of 0 in any otherwise-null fields.

Also, make sure that the exact text is correct on the rex lines (eg "Out of stock" vs "Out Of Stock")