https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63931#M180344 <P>Using <CODE>transaction</CODE> like Ayn suggests; you'll get multivalued fields. Assuming that you have a field called 'status' which in your case contains either 'error' or 'ok', you could do (after the transaction) </P> <PRE><CODE>| eval err = mvfilter(match(status, "error")) | eval err_count = mvcount(err) </CODE></PRE> <P>If all the events in the transaction contains <CODE>status=error</CODE>, you could use the <CODE>eventcount</CODE> field that is created by the <CODE>transaction</CODE>. Perhaps subtract 1 from the eventcount, if the 'READY TO ACTIVATE' event does not contain 'error'.</P> <P>Without sample events, it is a lot harder to give you good advice. </P> <P>/K</P> Fri, 14 Jun 2013 07:30:22 GMT kristian_kolb 2013-06-14T07:30:22Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63927#M180340 <P>Hi</P> <P>I have a log file , i want to search events for first occurrence of word "error" in that file, till the first occurrence of word "READY TO ACTIVATE".</P> <P>I want to list all the events between first occurrence of "error" and first occurrence of "READY TO ACTIVATE".</P> <P>Please help me ..........</P> Fri, 14 Jun 2013 06:26:23 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63927#M180340 ncbshiva 2013-06-14T06:26:23Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63928#M180341 <P>Hi</P> <P>I have a log file , i want to evaluate count of errors from line 1 of the file till the first occurrence of "READY TO ACTIVATE" phrase.</P> <P>Please help me ..........</P> Fri, 14 Jun 2013 06:43:53 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63928#M180341 ncbshiva 2013-06-14T06:43:53Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63929#M180342 <P>Use <CODE>transaction</CODE>.</P> <PRE><CODE>... | transaction startswith="error" endswith="READY TO ACTIVATE" </CODE></PRE> Fri, 14 Jun 2013 07:00:48 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63929#M180342 Ayn 2013-06-14T07:00:48Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63930#M180343 <P>i have used the same, but i need to evaluate the count of "error" from line 1 till the first occurrence of "READY TO ACTIVATE"</P> <P>Thanks in advance.......</P> Fri, 14 Jun 2013 07:04:56 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63930#M180343 ncbshiva 2013-06-14T07:04:56Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63931#M180344 <P>Using <CODE>transaction</CODE> like Ayn suggests; you'll get multivalued fields. Assuming that you have a field called 'status' which in your case contains either 'error' or 'ok', you could do (after the transaction) </P> <PRE><CODE>| eval err = mvfilter(match(status, "error")) | eval err_count = mvcount(err) </CODE></PRE> <P>If all the events in the transaction contains <CODE>status=error</CODE>, you could use the <CODE>eventcount</CODE> field that is created by the <CODE>transaction</CODE>. Perhaps subtract 1 from the eventcount, if the 'READY TO ACTIVATE' event does not contain 'error'.</P> <P>Without sample events, it is a lot harder to give you good advice. </P> <P>/K</P> Fri, 14 Jun 2013 07:30:22 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63931#M180344 kristian_kolb 2013-06-14T07:30:22Z https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63932#M180345 <P>Hi kristian.kolb</P> <P>I am not getting the count of word "error" correctly, If there are two "error" words in the log file , its giving the count as one only....</P> <P>please help me....</P> Tue, 02 Jul 2013 12:44:45 GMT https://community.splunk.com/t5/Splunk-Search/Group-the-events/m-p/63932#M180345 ncbshiva 2013-07-02T12:44:45Z