I have some base splunk query which gives me list of events which has body mentioned below -
event 1.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}
event 2.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092001"}}}}}
event 3.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092000"}}}}}
event 4.
{"Errors":{"Error":{"RequestId":"112314082","Source":"","ReasonCode":"MISSING_REQUIRED_INPUT","Description":"Missing Required Input","Recoverable":"false","Details":{"Detail":{"Name":"ErrorDetailCode","Value":"092002"}}}}}
I need to group these events based on message body's ErrorDetailCode value.
e.g.
ErrorCode Count
092000 - 2
092001 - 1
092002 - 1
Can someone please help me or guide me to build as I am new to Splunk ?
| makeresults
| eval _raw="{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092001\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092000\"}}}}}
{\"Errors\":{\"Error\":{\"RequestId\":\"112314082\",\"Source\":\"\",\"ReasonCode\":\"MISSING_REQUIRED_INPUT\",\"Description\":\"Missing Required Input\",\"Recoverable\":\"false\",\"Details\":{\"Detail\":{\"Name\":\"ErrorDetailCode\",\"Value\":\"092002\"}}}}}"
| eval raw=split(_raw,"
")
| mvexpand raw
| rename raw as _raw
`comment("this is your sample")`
`comment("From here, the logic")`
| spath path=Errors.Error.Details.Detail.Value output=ErrorCode
| stats count by ErrorCode
Hi, how about this?
Hi @dhirajnangar try:
...your serach|rex field=_raw "ErrorDetailCode.+Value\":\"(?P<errorCode>\d+)" |stats count by errorCode