Splunk Enterprise

How to rex multiple fields and represent in a chart?


I am trying to chart my output from logs to rex for different errors like
i. "com.ibm.mq.MQException" as MQError
ii. "ORA Error" as DB error
iii. "OutOfMemory Error" as OOM

The above errors are part of the log event and are not classified by any fields.

Tags (1)
0 Karma

Esteemed Legend

Maybe this:

index=AlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| eval error=case(
   searchmatch("com.ibm.mq.MQException"), "MQError",
   searchmatch("ORA Error"),              "DB error",
   searchmatch("OutOfMemory Error"),      "OOM",
   true(),                                "Unknown")
| stats count BY error
0 Karma


Hi pranay04,

That's pretty easy and straight forward in Splunk 🙂
Based on your provided examples take this run everywhere command:

| makeresults 
| eval flubber="com.ibm.mq.MQException,ORA Error,OutOfMemory Error" 
| makemv delim="," flubber 
| mvexpand flubber 
| rename comment AS "Everything above this was used to create dummy data!" 
| eval status=case(match(flubber, "com.ibm.mq.MQException"), "MQError", match(flubber, "ORA Error"), "DB error",match(flubber, "OutOfMemory Error"), "OOM", 1=1, " ¯\_(ツ)_/¯ ") 
| chart count by status

The result will look like this:

alt text

Hope this helps ...

cheers, MuS

0 Karma

Esteemed Legend

Please start over and add many more words of description. I have no idea what you need. Always provide final output mockups so that even if your descriptions are lacking, we can get the gist.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...