Alerting

how to write query for muliple keyword in stats ?

karthi2809
Builder

I had four different keyword( job Success msg ) and need to display job name and status.but i am getting counts

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString _time

Actual result:

First job          5

second Job   7

Excpected output:

first job                           Success
Second job                    Success

Third job                         failure

Labels (4)
0 Karma
1 Solution

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

View solution in original post

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by searchString
| eval status=if(count>0,"Success","Failure")

0 Karma

karthi2809
Builder

Thank you lot 

The result to be for daily basis

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

Tags (1)
0 Karma

karthi2809
Builder
 
0 Karma

karthi2809
Builder

Thanks you

Can you please help on how to show the result for daily basis 

Expected output:

20/6/20

first job                           Success
Second job                    Success

Third job                         Success

19/6/20

first job                           Success
Second job                    Success

Third job                         Success

18/6/20

first job                           Success
Second job                    Success

Third job                         Success

 

 

0 Karma

to4kawa
Ultra Champion

index=* cf_app_name="s*" OR cf_app_name=nd* ("All feed is completed" OR "XXX Success: XXX" OR "YYY Success: YYY" OR "Finished handshake success" )
| eval searchString = case(like(_raw, "%All feed is completed%"), "First Job", like(_raw, "%XXX Success: XXX%"), "Second Job", like(_raw, "%YYY Success: YYY%"), "third job",like(_raw, "%Finished handshake success%"), "Fourth job", 1==1, "Incorrect searchString match, please refactor")
| bin span=1d _time
| stats count by _time searchString
| append [ makeresults
| eval searchString=split("First Job,Second Job,Third Job,Fourth Job",",")
| mvexpand searchString
| fields - _time]
| stats count(count) as count by _time searchString
| eval status=if(count>0,"Success","Failure")

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...