topic Help with Search string count in Splunk Search

Help with Search string count

D01033778 — Thu, 31 Jan 2013 19:02:35 GMT

I am trying to extract a string, count how many times it appears and group it by host.

RAW LOG:

[2013-01-31T03:55:06.739-06:00] [soa_server2] [ERROR] [] [oracle.soa.bpel.engine.dispatch] [tid: orabpel.invoke.pool-4.thread-16] [userId: ] [ecid: b5e97102d2ab8130:-37493125:13c69c08931:-8000-00000000003946d4,0] [APP: soa-infra] failed to handle message[[ORABPEL-09705 Could not initialize variable.An error occurs while initializing BPEL variable inputVariable; the schema processor cannot find the element

Search Expression:

host="stiint2app2" OR host="stiint2app1" | chart count(ORABPEL-05002) AS ERROR:ORABPEL-05002,
count(ORABPEL-09705) AS ERROR:ORABPEL-09705,
count(ORABPEL-35009) AS ERROR:ORABPEL-35009,
count(ORABPEL-9732) AS ERROR:ORABPEL-9732 by host

Results:

host ERROR:ORABPEL-05002 ERROR:ORABPEL-09705 ERROR:ORABPEL-35009 ERROR:ORABPEL-9732

1 stiint2app1 0 0 0 0

2 stiint2app2 0 0 0 0

Currently I am not getting the exact results that I am looking for. Example I have actual count of 37 occurences for ORABPEL-09705, today but my results show 0.

Re: Help with Search string count

Ayn — Thu, 31 Jan 2013 19:36:40 GMT

Your syntax seems to a bit off. By the looks of it, it seems that you're assuming that count(blah) will match the raw log for "blah" and return the count of events where a match was found. This is not the case. count(blah) will count how many events the FIELD "blah" exists in. If you want to match something against the raw event, you'll want to do count(eval(searchmatch("blah"))).

So, with the query rewritten with those changes, it'll look something like

host="stiint2app2" OR host="stiint2app1" | chart count(eval(searchmatch("ORABPEL-05002"))) AS ERROR:ORABPEL-05002, count(eval(searchmatch("ORABPEL-09705"))) AS ERROR:ORABPEL-09705, count(eval(searchmatch("ORABPEL-35009"))) AS ERROR:ORABPEL-35009, count(eval(searchmatch("ORABPEL-9732"))) AS ERROR:ORABPEL-9732 by host

Personally I would go for a somewhat different approach - create a field extraction that matches the individual error ID's after the "ORABPEL-" string, so a field would be created (calling it ORABPEL seems appropriate) holding the various error ID's. Having done that, just doing

host="stiint2app2" OR host="stiint2app1" | chart count by ORABPEL,host

would suffice.

Re: Help with Search string count

stefandagerman — Thu, 31 Jan 2013 19:37:48 GMT

Are the arguments to the count() function field names or strings?

Re: Help with Search string count

D01033778 — Thu, 31 Jan 2013 19:55:44 GMT

Thanks for much. The first example works like a charm. I will look into creating the field extraction as well.

Thanks Again.