topic Re: How to count valid and invalid requests at the same time? in Splunk Search

How to count valid and invalid requests at the same time?

vamshiverma — Tue, 29 Sep 2020 18:40:28 GMT

Hello,

I want to display the total count of events and failed events count. In my case, it is determined by the field DETAIL

The following query does return the count by sourcetype "foo.bar.* and having error or exception.

index=myindex sourcetype=foo.bar.* DETAIL ="*error*" OR DETAIL ="*exception*"| stats count(UNIQUE_ID) as Fail by sourcetype

Sourcetype	Fail
foo.bar.cat	3
foo.bar.dog	2

I tried to query using the following to determine total events for individual sourcetype and the fails for the same. But, the fails are always returned as zero.

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | search index=myindex sourcetype=foo.bar* DETAIL ="*error*" OR DETAIL ="*exception*"|stats count(UNIQUE_ID) as Fail by src| fields sourcetype Total Fail

Sourcetype	Total	Fail
foo.bar.cat	153	0
foo.bar.dog	128	0

I tried using subsearch for the below query, but this one doesn't even work at all.

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | stats count(eval( DETAIL ="*error*" OR DETAIL ="*exception*")) as fail values(Total) as Total by src | fields src Total fail

I appreciate your time and support!

Thanks!!

Re: How to count valid and invalid requests at the same time?

richgalloway — Tue, 29 Sep 2020 18:40:53 GMT

You may not need a subsearch. Try this query.

index=myindex sourcetype=foo.bar* | eval status=if(searchmatch(DETAIL ="*error*" OR DETAIL ="*exception*"), "Fail", "Success") | stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype | fields sourcetype Total Fail

Re: How to count valid and invalid requests at the same time?

vamshiverma — Tue, 29 Sep 2020 19:58:24 GMT

@richgalloway Thank you for the reply, I appreciate it.

I tried to run the same query but it is throwing "Error in 'eval' command: The arguments to the 'searchmatch' function are invalid."

Re: How to count valid and invalid requests at the same time?

richgalloway — Tue, 29 Sep 2020 20:42:26 GMT

Sorry about that. Try this alternative.

index=myindex sourcetype=foo.bar* | eval status=case(searchmatch(DETAIL ="*error*"), "Fail", searchmatch(DETAIL ="*exception*"), "Fail", 1==1, "Success") | stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype | fields sourcetype Total Fail

Re: How to count valid and invalid requests at the same time?

Nisha18789 — Tue, 29 Sep 2020 21:20:29 GMT

@vamshiverma , can you try below and see if you getting the desired results

index=myindex sourcetype=foo.bar.*
|eval type=if(DETAIL="*error*" OR DETAIL="*exception*","Fail","other")
|stats count(UNIQUE_ID) as Total sum(eval(status="Fail")) as Fail by sourcetype

Re: How to count valid and invalid requests at the same time?

askkawalkar — Wed, 30 Sep 2020 06:05:20 GMT

index=myindex sourcetype=foo.bar* | eval status=case(like(DETAIL,"%error%"),"Fail",like(DETAIL,"%exception%"),"Fail",true(), "Success") | stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype | fields sourcetype Total Fail

Hi @vamshiverma , can you please try using above.

Regards,

Ankush

Re: How to count valid and invalid requests at the same time?

vamshiverma — Wed, 30 Sep 2020 08:55:47 GMT

Thank you! @askkawalkar. It helped a lot. Awesome!😊

Re: How to count valid and invalid requests at the same time?

vamshiverma — Wed, 30 Sep 2020 08:50:39 GMT

Thank you !! @Nisha18789 , it's working. 😀

Re: How to count valid and invalid requests at the same time?

vamshiverma — Wed, 30 Sep 2020 08:53:01 GMT

@richgalloway slick and smooth way to solve, thanks a lot!! 😊

Re: How to count valid and invalid requests at the same time?

askkawalkar — Wed, 30 Sep 2020 08:56:59 GMT

@vamshiverma , Kindly accept answer for question, which is most helpful, So that others can use it if required.

Regards,

Ankush

Re: How to count valid and invalid requests at the same time?

richgalloway — Wed, 30 Sep 2020 12:56:40 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.