topic Re: Help with splunk query, searchmatch finding false positives in Splunk Search

Help with splunk query, searchmatch finding false positives

hamishcross — Mon, 05 Aug 2019 07:20:50 GMT

Hey All,

Very new to using splunk and love the power of dashboards.

I'm executing the following

index=my_app ("C4C Auth Scenario")| stats count(eval(searchmatch("C4C Auth Scenario 1"))) as "S1", count(eval(searchmatch("C4C Auth Scenario 2"))) as "S2", count(eval(searchmatch("C4C Auth Scenario 3"))) as "S3", count(eval(searchmatch("C4C Auth Scenario 4Y"))) as "S4Y", count(eval(searchmatch("C4C Auth Scenario 4N"))) as "S4N", count(eval(searchmatch("C4C Auth Scenario 5"))) as "S5", count(eval(searchmatch("C4C Auth Scenario 6"))) as "S6" | untable blank Reason Count | table Reason Count

And I'm finding that S6 is returning false positives.

If I execute index=my_app "C4C Auth Scenario 6" no results are returned.

Yet if I execute the full query above, it returns multiple rows in the count

What would the cause of this be, and how do I go about ensuring it doesn't occur.

I'm looking to create a dashboard based on the occurrence of logging events.

Any help would be greatly appreciated.

Re: Help with splunk query, searchmatch finding false positives

FrankVl — Mon, 05 Aug 2019 12:49:25 GMT

I don't have an immediate answer for the difference in search results and the 'false positives' you experienced. Are you sure both searches were ran over the same time window?

Anyway, I would solve this by extracting the scenario 'number' into a field and then doing a stats by that field.

For example (you want to implement this with automatic field extractions in the end, so you don't need the line with the rex command anymore):

index=my_app ("C4C Auth Scenario")
| rex "C4C Auth Scenario (?<Reason>\w+)"
| stats count by Reason

Re: Help with splunk query, searchmatch finding false positives

hamishcross — Tue, 06 Aug 2019 05:07:43 GMT

Thanks mate, that worked pretty well. Only thing I would say is I had to remove the "index=my_app" after rex to make it work. Was this in error or have I made a mistake?

Re: Help with splunk query, searchmatch finding false positives

FrankVl — Tue, 06 Aug 2019 12:55:53 GMT

Oh, yeah, copy paste mistake. Let me update it to prevent confusion if someone else reads this in the future 🙂

Re: Help with splunk query, searchmatch finding false positives

hamishcross — Wed, 07 Aug 2019 01:07:22 GMT

Awesome! For newbies like me, if it doesn't work, finding the problem can be really problematic. So really good to ensure the examples work. Thanks again