topic Re: Grouping by the words in a field in Splunk Search

Grouping by the words in a field

H2ck1ngPr13sT — Tue, 15 Oct 2024 12:07:03 GMT

HI,

I have a below query, I want to group and count by two different words, one group per word, in a field "text1.value" which are Load Balancer and Endpoints words are located somewhere in a string. Also I want to count how many of them occured per one day.

Is this possible?

index=monitor name="Manager - Error" text2.value="*Rerun" text1.value="*Load Balancer*" OR "*Endpoints*"

Re: Grouping by the words in a field

gcusello — Tue, 15 Oct 2024 12:18:12 GMT

Hi @H2ck1ngPr13sT ,

if you want your count for one day, you could use something like this:

index=monitor name="Manager - Error" text2.value="*Rerun" text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-1d latest=now | rename text1.value AS text1_value | stats count(eval(searchmatch(text1_value,"Load Balancer"))) AS LoadBalancer count(eval(searchmatch(text1_value,"Endpoints"))) AS Endpoints

if instead yu want the values for each day in the last 7 days, you could use something like this:

index=monitor name="Manager - Error" text2.value="*Rerun" text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-17 latest=now | rename text1.value AS text1_value | eval type=if(searchmatch(text1_value,"Load Balancer"),"LoadBalancer", "Endpoints") | timechart span=1d count BY type

Ciao.

Giuseppe

Re: Grouping by the words in a field

H2ck1ngPr13sT — Tue, 15 Oct 2024 16:23:30 GMT

Unfortunately, I'm getting error: "Error in 'EvalCommand': The arguments to the 'searchmatch' function are invalid." I've tried both solutions.

Re: Grouping by the words in a field

yuanliu — Tue, 15 Oct 2024 19:25:53 GMT

Replace searchmatch(text1_value,"Load Balancer") with searchmatch("text1_value=\"*Load Balancer*\""), and so on. BTW, rename is not needed for searchmatch because it accepts any syntax/shortcut that the search command accepts. (Like search, it also does case-insensitive match.) For example,

index=monitor name="Manager - Error" text2.value="*Rerun" text1.value IN ("*Load Balancer*", "*Endpoints*") earliest=-1d latest=now | stats count(eval(searchmatch("text1.value=\"*Load Balancer*\""))) AS LoadBalancer count(eval(searchmatch("text1.value = \"*Endpoints*\""))) AS Endpoints

Re: Grouping by the words in a field

gcusello — Wed, 16 Oct 2024 07:04:50 GMT

Hi @H2ck1ngPr13sT ,

sorry I confused searchmatch with match, please use match function.

Ciao.

Giuseppe