Stats on the count of Information and critical logs in Splunk

[macadminrohit]

We have logs in splunk with field level=ERROR OR INFORMATION OR CRITICAL , we want to do a stats on the count of (ERROR OR CRITICAL ) events and INFORMATION events.

Basically we want to see the ratio of INFORMATION events by NON INFORMATION events per app.

[somesoni2 · Accepted solution]

You base search is wrongly grouped for level field filter if it's same as what you posted in the question. All level field fields should be applied with ORed list as you want to select events with all three values of field level. You current search looks for level=Information AND level=Error or level=Critical and it's not possible as level can't have two values in the same event. Try like this

index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | stats count(eval(if(level!="Information",1,null))) as ErrorCount count(eval(if(level="Information",1,null))) as InfoCount by hdr.appName

Another option

 index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | chart count over hdr.appName by level
| rename Information as InfoCount | eval ErrorCount=Error+Critical | table hrd.appName ErrorCount InfoCount

[macadminrohit]

I changed my search to exclude the level, still it is not showing any values other than 0. But your second search worked well.

[macadminrohit]

I wrote a query like this :

index=servers sourcetype=json app=* level=Error OR level=Critical level=Information | stats count(eval(if(level!="Information",1,null))) as ErrorCount count(eval(if(level="Information",1,null))) as InfoCount by hdr.appName

but it displays 0 for all the counts of ErrroCount and InfoCount, whereas i had the matching events.

[macadminrohit]

changed it to stats count(eval(level!="Information")) as ErrorCount count(eval(level="Information")) as InfoCount by appName, still showing 0 for everything.

[493669]

can you try this:

index=servers sourcetype=json|stats count(eval(level!="Information")) as ErrorCount count(eval(level="Information")) as InfoCount by appName

[macadminrohit]

still returns 0 for everything.