Splunk Search

Blind mask with eval

dabroma5
Explorer

Hi, 

I would like to count how many times "Booking failed with 1 source conflict and 1 destination conflict" message occurs in the log. 

 

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( bookname="failed with 1 source conflict and 1 destination conflict\"", "Booking failed with 1 source conflict and 1 destination conflict" )
| stats  count by Reason

 

 

old logline:

 

"2021-05-11 13:59:39,615 backend_7.20.47: INFO services/PathManagerService(backend): Booking failed with 1 source conflict and 1 destination conflict"

 

 

new logline:

"2021-06-27 14:24:33,513 backend_8.20.26: INFO vip.service.PathManagerService Booking failed with 1 source conflict and 1 destination conflict [1930711-4]"

After the system upgrade, I don't know how to ignore [1930711-4] part.

Labels (2)
Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dabroma5 

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict")
| stats  count by Reason

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this, here is one

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
| rex field=bookname "(?<Reason>Booking failed with 1 source conflict and 1 destination conflict)"
| stats  count by Reason
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dabroma5 

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict")
| stats  count by Reason

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

dabroma5
Explorer

Thanks, this one suits me best.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...