Alerting

how to write query for muliple keyword in stats ?

karthi2809
Builder

I had four different keyword( job Success msg ) and need to display job name and status.but i am getting counts

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString _time

Actual result:

First job          5

second Job   7

Excpected output:

first job                           Success
Second job                    Success

Third job                         failure

Labels (4)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

View solution in original post

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

0 Karma

karthi2809
Builder

Thank you lot 

The result to be for daily basis

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

Tags (1)
0 Karma

karthi2809
Builder
 
0 Karma

karthi2809
Builder

Thanks you

Can you please help on how to show the result for daily basis 

Expected output:

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

18/6/20

first job                           Success
Second job                    Success

Third job                         Success

 

 

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| bin span=1d _time
| stats count by _time searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by _time searchString
| eval status=if(count>0,"Success","Failure")

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...