Splunk Enterprise

How to rex multiple fields and represent in a chart?


I am trying to chart my output from logs to rex for different errors like
i. "com.ibm.mq.MQException" as MQError
ii. "ORA Error" as DB error
iii. "OutOfMemory Error" as OOM

The above errors are part of the log event and are not classified by any fields.

Tags (1)
0 Karma

Esteemed Legend

Maybe this:

index=AlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| eval error=case(
   searchmatch("com.ibm.mq.MQException"), "MQError",
   searchmatch("ORA Error"),              "DB error",
   searchmatch("OutOfMemory Error"),      "OOM",
   true(),                                "Unknown")
| stats count BY error
0 Karma


Hi pranay04,

That's pretty easy and straight forward in Splunk 🙂
Based on your provided examples take this run everywhere command:

| makeresults 
| eval flubber="com.ibm.mq.MQException,ORA Error,OutOfMemory Error" 
| makemv delim="," flubber 
| mvexpand flubber 
| rename comment AS "Everything above this was used to create dummy data!" 
| eval status=case(match(flubber, "com.ibm.mq.MQException"), "MQError", match(flubber, "ORA Error"), "DB error",match(flubber, "OutOfMemory Error"), "OOM", 1=1, " ¯\_(ツ)_/¯ ") 
| chart count by status

The result will look like this:

alt text

Hope this helps ...

cheers, MuS

0 Karma

Esteemed Legend

Please start over and add many more words of description. I have no idea what you need. Always provide final output mockups so that even if your descriptions are lacking, we can get the gist.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.