Searchmatch

[suvi6789]

Hi, 
I have doing a list of different searches and want the count of each searches. 
So, I was using the searchmatch command but when using it I get only the first result that is successfully searches and it ignore the rest

For example:

index="abc" 
| eval JobName= case(
searchmatch("error 1234", Error1),
searchmatch("error 567", Error2),
searchmatch("error 89", Error3)
)
| stats count by JobName

Output says 
Error1 - 234 (234 is the count of error)

though error 2 and error 3 are there, It is not listing in the results. 
Please could you suggest on how to get this sorted

[PickleRick]

That's how case works - it returns the value for the first matching condition. If you want to evaluate all conditions, you have to do three separate evals and assign values to three separate fields.

[suvi6789]

Thank you for your response

If I comment the first search
index="abc" 
| eval JobName= case(
```searchmatch("error 1234"), "Error1",```
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)

Now, the result is 
Error2 - 125

[suvi6789]

If I comment 
index="abc" 
| eval JobName= case(
```searchmatch("error 1234"), "Error1",```
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)

Now, the result is 
Error2 - 125

[gcusello]

Hi @suvi6789 ,

Only for test, please try this:

index="abc" 
| stats 
     count(eval(searchmatch("error 1234"))) AS "Error1"
     count(eval(searchmatch("error 567"))) AS "Error12"
     count(eval(searchmatch("error 89"))) AS "Error3"

the issue is probably on the data, you must analyze them

Ciao.

Giuseppe

[suvi6789]

Thanks for the response
My Bad, the parenthesis are wrong. I have ran the query with the right paranthesis. It was a typo.

index="abc" 
| eval JobName= case(
searchmatch("error 1234"), "Error1",
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)
| stats count by JobName

Output says 
Error1 - 234 (234 is the count of error)

though error 2 and error 3 are there, It is not listing in the results. 

[gcusello]

Hi @suvi6789 ,

the search is correct, are you sure about the strings to search for Error 2 and 3?

Only for debugging, please change the order of searchmatch in the eval.

Ciao.

Giuseppe

[gcusello]

Hi @suvi6789 ,

parenthesis are wrong and if Error1,2 and3 are strings, use quotes:

index="abc" 
| eval JobName= case(
searchmatch("error 1234"), "Error1",
searchmatch("error 567"), "Error2",
searchmatch("error 89"), "Error3"
)
| stats count by JobName