Blind mask with eval

[dabroma5]

Hi, 

I would like to count how many times "Booking failed with 1 source conflict and 1 destination conflict" message occurs in the log. 

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( bookname="failed with 1 source conflict and 1 destination conflict\"", "Booking failed with 1 source conflict and 1 destination conflict" )
| stats  count by Reason

old logline:

"2021-05-11 13:59:39,615 backend_7.20.47: INFO services/PathManagerService(backend): Booking failed with 1 source conflict and 1 destination conflict"

new logline:

"2021-06-27 14:24:33,513 backend_8.20.26: INFO vip.service.PathManagerService Booking failed with 1 source conflict and 1 destination conflict [1930711-4]"

After the system upgrade, I don't know how to ignore [1930711-4] part.

[ITWhisperer]

There are a number of ways to do this, here is one

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
| rex field=bookname "(?<Reason>Booking failed with 1 source conflict and 1 destination conflict)"
| stats  count by Reason

[kamlesh_vaghela · Accepted solution]

@dabroma5 

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict")
| stats  count by Reason

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[dabroma5]

Thanks, this one suits me best.