topic Re: Displaying 2 counts (error and total) in Splunk Search

Displaying 2 counts (error and total)

shashankjuloori — Tue, 24 Mar 2020 17:27:59 GMT

There is a requirement in which i need to display total count and errors(in total count). error message is in raw text.

Re: Displaying 2 counts (error and total)

darrenfuller — Tue, 24 Mar 2020 18:30:08 GMT

Hi shashankjuloori.

Not a lot to go on here. is the error message extracted in a field or only in _raw? Can you share an event or two of sample data to help out a bit|?

./d

Re: Displaying 2 counts (error and total)

shashankjuloori — Tue, 24 Mar 2020 18:44:15 GMT

error message has to be extracted from raw text. Then i need to display total events count and error events count.

Re: Displaying 2 counts (error and total)

richgalloway — Tue, 24 Mar 2020 19:09:02 GMT

Still not enough to work with. Please provide some sample events (mask private data) and desired output.

Re: Displaying 2 counts (error and total)

shashankjuloori — Tue, 24 Mar 2020 19:21:25 GMT

field1= || field2= || field3= || message------------error text ----------/message
this is the error message structure.

here i need to separate the events which contains error text, suppose it to be errors and display both total count and error count.

Re: Displaying 2 counts (error and total)

to4kawa — Tue, 24 Mar 2020 21:24:28 GMT

we can extract error text and message
but, isn't these actual logs?

Re: Displaying 2 counts (error and total)

woodcock — Tue, 24 Mar 2020 23:30:14 GMT

Like this:

... | rex to create error_text
| stats dc(error_text) AS "error count" count AS "total count" by foundation
| eventstats sum('total count') AS "grand total count"

Re: Displaying 2 counts (error and total)

shashankjuloori — Wed, 25 Mar 2020 10:39:20 GMT

Sorry, i cant paste the logs due to security reasons.
Events are logged based on the field foundation, suppose A, B, C.
and logs will be like

index=* Foundation=A | field1 | field2| ...message......errortest.../message
index=* Foundation=A | field1 | field2| ...message......errortest.../message
index=* Foundation=B | field1 | field2| ...message......errortest.../message
index=* Foundation=C | field1 | field2| ...message......errortest.../message

here i need to segregate the events based on the error text and total count, and the output should be like

Foundation        |  error count   | total count
   A            count             count
   B            count             count
   C            count            count

and i am sorry for messing up the things.

Re: Displaying 2 counts (error and total)

richgalloway — Wed, 25 Mar 2020 12:48:09 GMT

Vague questions beget vague answers. @woodcock has the general idea. We must leave it to you to figure out how to extract the error text from each message since we don't have enough information about the structure of the messages.

Re: Displaying 2 counts (error and total)

woodcock — Wed, 25 Mar 2020 14:14:11 GMT

I updated my vague answer.

Re: Displaying 2 counts (error and total)

shashankjuloori — Wed, 25 Mar 2020 14:16:37 GMT

Thanks for the help.