Splunk Search

Blind mask with eval

dabroma5
Explorer

Hi, 

I would like to count how many times "Booking failed with 1 source conflict and 1 destination conflict" message occurs in the log. 

 

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( bookname="failed with 1 source conflict and 1 destination conflict\"", "Booking failed with 1 source conflict and 1 destination conflict" )
| stats  count by Reason

 

 

old logline:

 

"2021-05-11 13:59:39,615 backend_7.20.47: INFO services/PathManagerService(backend): Booking failed with 1 source conflict and 1 destination conflict"

 

 

new logline:

"2021-06-27 14:24:33,513 backend_8.20.26: INFO vip.service.PathManagerService Booking failed with 1 source conflict and 1 destination conflict [1930711-4]"

After the system upgrade, I don't know how to ignore [1930711-4] part.

Labels (2)
Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dabroma5 

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict")
| stats  count by Reason

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are a number of ways to do this, here is one

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
| rex field=bookname "(?<Reason>Booking failed with 1 source conflict and 1 destination conflict)"
| stats  count by Reason
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@dabroma5 

Can you please try this for your both logs?

index="xx" OR index=main host="xxx" "booking failed" source="/opt/ipath/log/main.log" NOT update NOT Details  
 | eval Reason = case( like(bookname,"failed with 1 source conflict and 1 destination conflict%\""), "Booking failed with 1 source conflict and 1 destination conflict")
| stats  count by Reason

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

dabroma5
Explorer

Thanks, this one suits me best.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...