topic Re: The stats command isn't returning any results? in Splunk Search

The stats command isn't returning any results?

mperren — Tue, 11 Feb 2014 17:50:25 GMT

I have the following splunk query:

search (...) AND ERROR
    | rex field=error "^.*(?<vcbn>Value cannot be null.)$"
    | stats count(vcbn) by error

but for whatever reason the stats count(vcbn) by error isn't generating any results.

Additionally, the rex field=error "^.*(?<vcbn>Value cannot be null.)$" isn't building a new field in the list on the left of the event search results.

The search itself returns 170 events.

Re: The stats command isn't returning any results?

richgalloway — Tue, 11 Feb 2014 18:14:18 GMT

Start by displaying just the results of your search (everything before "rex") to make sure you're getting the events you think you're getting. Do you have a field called 'error'? If you want to capture the full stop at the end of the error message it should be escaped (.).

Re: The stats command isn't returning any results?

mperren — Tue, 11 Feb 2014 18:16:59 GMT

I don't get a field called error, I thought I was trying to make a field called error that pulled out that text and then get stats on it. However, I do get the results I'm expecting with just the search.

Re: The stats command isn't returning any results?

richgalloway — Tue, 11 Feb 2014 18:31:50 GMT

I thought that might be the case. The field argument to the rex command tells rex what field to parse. Results are put into fields created by the '?<vcbn>' construct.

Re: The stats command isn't returning any results?

mperren — Tue, 11 Feb 2014 18:37:45 GMT

@richgalloway: got it, so after changing it up a bit to rex "^.*(?<vcbn>Value cannot be null.)$" | stats count(vcbn) by _raw I get a graph - but it's empty. What might I have missed there? I've also noticed that the results listing no longer has these errors listed.

Re: The stats command isn't returning any results?

somesoni2 — Tue, 11 Feb 2014 18:39:45 GMT

please provide some sample log entries and the portion which have to be extracted as vcbn.

Re: The stats command isn't returning any results?

linu1988 — Tue, 11 Feb 2014 18:46:14 GMT

what do you get in vcbn? do you get all the values which you expect? And what i think you would like count on vcbn

rex "^.*(?Value cannot be null.)$" | stats count(vcbn) by vcbn

Re: The stats command isn't returning any results?

richgalloway — Tue, 11 Feb 2014 18:47:24 GMT

Try 'stats count(vcbn)'. Since your search is only returning a single value, there is no grouping and so no use for a by clause.

Re: The stats command isn't returning any results?

the_wolverine — Tue, 11 Feb 2014 19:37:05 GMT

search (...) AND ERROR
    | rex field=error "^.*(?<vcbn>Value cannot be null.)$"
    | stats count by vcbn