Hello Splunkers!!
I have two weeks events week 1 & week 2. Here I need to compare event of Week 1 & Week 2. The highlighted red one is the new event in Week 2. Like wise I have 100 of events in week 1 and week 2. If any new events comes in week 2 I need that result. Please let me know how to approach with this.
Message | |
Week 1 | Week 2 |
Template:account/backToAccount | Template:account/backToAccount |
"enableEnhancedCheckout" is not defined | "enableEnhancedCheckout" is not defined |
"product" is not defined |
Below is the query I have created so far :
index="ABC" ("ERROR" OR "EXCEPTION") earliest=-7d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" | rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception_7d= coalesce(Message,Error2,Exception,ErrorM)
| stats count by Error_Exception_7d | sort - count
| appendcols
[ search index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=-8d
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" | rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception_14d= coalesce(Message,Error2,Exception,ErrorM)
| stats count by Error_Exception_14d | sort - count]
| stats count by Error_Exception_14d Error_Exception_7d
Hi @uagraw01,
this is a not performat search and there's the limit of 50,000 results in subsearches, please try a different approach using eval and stats dc, something like this:
index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)"
| rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception= coalesce(Message,Error2,Exception,ErrorM)
| eval week=if(now()-_time<604800,"last week","previous week")
| stats dc(week) AS week_count values(week) AS week by Error_Exception
| eval kind=if(week_count=2,"both weeks",week
| table Error_Exception kind
in this way you can configure the filters you like, e.g. new Error_Exception.
I didn't analyzed your regexes and eval that I suppose are correct.
Ciao.
Giuseppe
Hi @uagraw01,
this is a not performat search and there's the limit of 50,000 results in subsearches, please try a different approach using eval and stats dc, something like this:
index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)"
| rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception= coalesce(Message,Error2,Exception,ErrorM)
| eval week=if(now()-_time<604800,"last week","previous week")
| stats dc(week) AS week_count values(week) AS week by Error_Exception
| eval kind=if(week_count=2,"both weeks",week
| table Error_Exception kind
in this way you can configure the filters you like, e.g. new Error_Exception.
I didn't analyzed your regexes and eval that I suppose are correct.
Ciao.
Giuseppe
@gcusello Thanks for your valuable inputs. Let me try and observe.