topic Re: Blind mask with eval in Splunk Search

Blind mask with eval

dabroma5 — Mon, 28 Jun 2021 10:21:36 GMT

Hi,

I would like to count how many times "Booking failed with 1 source conflict and 1 destination conflict" message occurs in the log.

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details | eval Reason = case( bookname="failed with 1 source conflict and 1 destination conflict\"", "Booking failed with 1 source conflict and 1 destination conflict" ) | stats count by Reason

old logline:

"2021-05-11 13:59:39,615 backend_7.20.47: INFO services/PathManagerService(backend): Booking failed with 1 source conflict and 1 destination conflict"

new logline:

"2021-06-27 14:24:33,513 backend_8.20.26: INFO vip.service.PathManagerService Booking failed with 1 source conflict and 1 destination conflict [1930711-4]"

After the system upgrade, I don't know how to ignore [1930711-4] part.

Re: Blind mask with eval

kamlesh_vaghela — Mon, 28 Jun 2021 10:41:28 GMT

@dabroma5

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict") | stats count by Reason

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Blind mask with eval

ITWhisperer — Mon, 28 Jun 2021 10:46:31 GMT

There are a number of ways to do this, here is one

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details | rex field=bookname "(?<Reason>Booking failed with 1 source conflict and 1 destination conflict)" | stats count by Reason

Re: Blind mask with eval

dabroma5 — Mon, 28 Jun 2021 11:29:17 GMT

Thanks, this one suits me best.