Alerting

how to write query for muliple keyword in stats ?

karthi2809
Builder

I had four different keyword( job Success msg ) and need to display job name and status.but i am getting counts

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString _time

Actual result:

First job          5

second Job   7

Excpected output:

first job                           Success
Second job                    Success

Third job                         failure

Labels (4)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

View solution in original post

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

0 Karma

karthi2809
Builder

Thank you lot 

The result to be for daily basis

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

Tags (1)
0 Karma

karthi2809
Builder
 
0 Karma

karthi2809
Builder

Thanks you

Can you please help on how to show the result for daily basis 

Expected output:

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

18/6/20

first job                           Success
Second job                    Success

Third job                         Success

 

 

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| bin span=1d _time
| stats count by _time searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by _time searchString
| eval status=if(count>0,"Success","Failure")

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...