Splunk Search

Can someone help with my Splunk search to find new events in 2 week periods?

uagraw01
Builder

Hello Splunkers!!

I have two weeks events week 1 & week 2. Here I need to compare event of Week 1 & Week 2. The highlighted red one is the new event in Week 2. Like wise I have 100 of events in week 1 and week 2. If any new events comes in week 2  I need that result. Please let me know how to approach with this.

Message
Week 1 Week 2
Template:account/backToAccount Template:account/backToAccount
"enableEnhancedCheckout" is not defined "enableEnhancedCheckout" is not defined
  "product" is not defined



Below is the query I have created so far :


index="ABC" ("ERROR" OR "EXCEPTION") earliest=-7d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" | rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception_7d= coalesce(Message,Error2,Exception,ErrorM)
| stats count by Error_Exception_7d | sort - count
| appendcols
[ search index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=-8d
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" | rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception_14d= coalesce(Message,Error2,Exception,ErrorM)
| stats count by Error_Exception_14d | sort - count]
| stats count by Error_Exception_14d Error_Exception_7d
Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @uagraw01,

this is a not performat search and there's the limit of 50,000 results in subsearches, please try a different approach using eval and stats dc, something like this:

index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" 
| rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception= coalesce(Message,Error2,Exception,ErrorM)
| eval week=if(now()-_time<604800,"last week","previous week")
| stats dc(week) AS week_count values(week) AS week by Error_Exception
| eval kind=if(week_count=2,"both weeks",week
| table Error_Exception kind

in this way you can configure the filters you like, e.g. new Error_Exception.

I didn't analyzed your regexes and eval that I suppose are correct.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @uagraw01,

this is a not performat search and there's the limit of 50,000 results in subsearches, please try a different approach using eval and stats dc, something like this:

index="ABC" ("ERROR" OR "EXCEPTION") earliest=-14d latest=now()
| rex field=_raw "Error\s(?<Message>.+)MulesoftAdyenNotification"
| rex field=_raw "fetchSeoContent\(\)\s(?<Exception>.+)"
| rex field=_raw "Error:(?<Error2>.+)"
| rex field=_raw "(?<ErrorM>Error in template script)+"
| rex field=_raw "(?ms)^(?:[^\\|\\n]*\\|){3}(?P<Component>[^\\|]+)" 
| rex "service=(?<Service>[A-Za-z._]+)" |rex "Sites-(?<Country>[A-Z]{2})"
| eval Error_Exception= coalesce(Message,Error2,Exception,ErrorM)
| eval week=if(now()-_time<604800,"last week","previous week")
| stats dc(week) AS week_count values(week) AS week by Error_Exception
| eval kind=if(week_count=2,"both weeks",week
| table Error_Exception kind

in this way you can configure the filters you like, e.g. new Error_Exception.

I didn't analyzed your regexes and eval that I suppose are correct.

Ciao.

Giuseppe

uagraw01
Builder

@gcusello Thanks for your valuable inputs. Let me try and observe. 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...