Hi,
I am new to splunk and would like guidance about how to only count 1 occurrence of the word ERROR per event.
example line:
2014-05-14 20:17:46,232 ERROR ejb.services.RestClientService Error processing response
my search is counting both errors in the line and i only need the first one
the search is:
index=main sourcetype=* source=* host=* ERROR source="D:/server.log"
WHat is your full search? How are you/search is counting it twice?
Are you just trying to select events with ERROR after timestamp? If yes try this
index=main sourcetype= source= host=* ERROR source="D:/server.log" | regex _raw="^\S+\s+\S+\s+ERROR\s.+"
If you're looking for just upper case ERROR, try this
index=main sourcetype= source= host=* CASE(ERROR) source="D:/server.log"
Brilliant it works for me, I needed the first ERROR after the timestamp.
thanks so much for your help.