topic Re: Searching multiple log messages and count their occurrence in Splunk Search

Searching multiple log messages and count their occurrence

asubramanian — Thu, 12 Sep 2019 19:12:05 GMT

index=my_index
earliest=-30d
"[ERR] Failed to connect with downstream node"
OR "[ERR] Failed to authenticate downstream node"
OR "[ERR] Downstream node sent invalid response"

I want to get the count of these log messages and plot their count using timechart like

| timechart count(NodeConnectionError), count(AuthenticationError), count(InvalidResponseError) limit=0

Can someone let me know how to determine this also is it possible to aggregate few message count like

| timechart (count(NodeConnectionError) + count(InvalidResponseError) ) as GenericError, count(AuthenticationError), limit=0

Re: Searching multiple log messages and count their occurrence

jacobpevans — Thu, 12 Sep 2019 19:29:56 GMT

Greetings @asubramanian,

Here's a run-anywhere search. Adapt it to your needs.

           | makeresults | eval _raw = "[ERR] Failed to connect with downstream node"
| append [ | makeresults | eval _raw = "[ERR] Failed to authenticate downstream node" ]
| append [ | makeresults | eval _raw = "[ERR] Downstream node sent invalid response"  ]

| rex "(?<Error>\[ERR\][\w\s]+(node|response))"
| eval ErrorType = case (Error=="[ERR] Failed to connect with downstream node", "NodeConnectionError" ,
                         Error=="[ERR] Downstream node sent invalid response" , "InvalidResponseError",
                         Error=="[ERR] Failed to authenticate downstream node", "AuthenticationError" )
| eval ErrorTypeGeneralized = case (ErrorType=="NodeConnectionError" , "GenericError",
                                    ErrorType=="InvalidResponseError", "GenericError",
                                    ErrorType=="AuthenticationError" , "AuthenticationError")
| timechart limit=0 count by ErrorTypeGeneralized

Re: Searching multiple log messages and count their occurrence

asubramanian — Thu, 12 Sep 2019 20:25:50 GMT

Thanks @jacobevans for the query, how do i specify the index and duration

I added the index and duration just before the reg ex search after the last append

index=my_index
earliest=-1d
 | rex "(?<Error>\[ERR\][\w\s]+(node|response))"

and getting an error

Error in 'append' command: The last argument must be a subsearch.