https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143952#M40037 <P>You can just use the string "MediaFailed" as a part of your search, something like:</P> <PRE><CODE>source=&lt;whatever&gt; "MediaFailed" | stats count </CODE></PRE> <P>That will search it matching the case.</P> Fri, 05 Dec 2014 16:31:49 GMT cpetterborg 2014-12-05T16:31:49Z https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143951#M40036 <P>I am trying to count occurrences of events from raw logs. Basically, if the log contains the string "MediaFailed", then count it. The difficulty is this string is not part of a key-value pair so I can't do an equality statement. I'm just looking for its existence within the entire log. I have tried the following, unsuccessfully:</P> <P>| eval failures=case(match(_raw,"MediaFailed"),uuid)</P> <P>Any help is appreciated!</P> Fri, 05 Dec 2014 16:23:15 GMT https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143951#M40036 andreacorrie 2014-12-05T16:23:15Z https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143952#M40037 <P>You can just use the string "MediaFailed" as a part of your search, something like:</P> <PRE><CODE>source=&lt;whatever&gt; "MediaFailed" | stats count </CODE></PRE> <P>That will search it matching the case.</P> Fri, 05 Dec 2014 16:31:49 GMT https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143952#M40037 cpetterborg 2014-12-05T16:31:49Z https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143953#M40038 <P>Something like this would work?</P> <PRE><CODE>| eval failures=if(match(_raw,"*MediaFailed*"),1,0) </CODE></PRE> Fri, 05 Dec 2014 16:35:18 GMT https://community.splunk.com/t5/Splunk-Search/Count-Occurrence-of-string-from-raw-log/m-p/143953#M40038 somesoni2 2014-12-05T16:35:18Z