Archive

trying to find if there is an suggestion to capture only the values that occurs in more than one event with a different value

Deepz2612
Explorer

Hi Team,

I would like to know if there is any way to extract/find only the values that is present in more than one event with different values associated.
To explain further on the scenario,below are the logs.

 msg:    for-service - [2019-03-15T06:01:05.554+0000] "GET /api/for*&byr=**12355**" 404

Please help!!
Thanks in advance!

Tags (1)
0 Karma

sandeepmakkena
Contributor
|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"
| stats dc(status) as StatusDC, values(status)  by vin 
| where StatusDC>1 
| table vin

I think this should help.
You can see dc(status), values of all the Status by vin by removing, where and table part to test.
Thanks!

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"
| stats dc(status) AS status_count values(status) BY vin
| search status_count > 1
0 Karma

nickhills
Ultra Champion

Hi @Deepz2612
Try adding this to the end of your search.

|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"|stats dc(vin) by vin, status
If my comment helps, please give it a thumbs up!
0 Karma

Deepz2612
Explorer

Hi nick,
Thanks!
But my requirement is to list "only" the vins which occurs more than once in logs but with different response code.

0 Karma

nickhills
Ultra Champion

Ah, so flip the dc, and use eventstats.
|rex "vin\=(?P<vin>[^\"]+)\"\s(?P<status>\d+)"|eventstats dc(status) by vin as status_count|where status_count>1|table _time vin status
(untested - typed on a phone)

If my comment helps, please give it a thumbs up!
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!