Alerting

how to write query for muliple keyword in stats ?

karthi2809
Builder

I had four different keyword( job Success msg ) and need to display job name and status.but i am getting counts

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString _time

Actual result:

First job          5

second Job   7

Excpected output:

first job                           Success
Second job                    Success

Third job                         failure

Labels (4)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

View solution in original post

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

0 Karma

karthi2809
Builder

Thank you lot 

The result to be for daily basis

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

Tags (1)
0 Karma

karthi2809
Builder
 
0 Karma

karthi2809
Builder

Thanks you

Can you please help on how to show the result for daily basis 

Expected output:

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

18/6/20

first job                           Success
Second job                    Success

Third job                         Success

 

 

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| bin span=1d _time
| stats count by _time searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by _time searchString
| eval status=if(count>0,"Success","Failure")

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...