- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Count Occurrence of string from raw log
andreacorrie
Explorer
12-05-2014
08:23 AM
I am trying to count occurrences of events from raw logs. Basically, if the log contains the string "MediaFailed", then count it. The difficulty is this string is not part of a key-value pair so I can't do an equality statement. I'm just looking for its existence within the entire log. I have tried the following, unsuccessfully:
| eval failures=case(match(_raw,"MediaFailed"),uuid)
Any help is appreciated!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![somesoni2 somesoni2](https://community.splunk.com/legacyfs/online/avatars/100305.jpg)
somesoni2
Revered Legend
12-05-2014
08:35 AM
Something like this would work?
| eval failures=if(match(_raw,"*MediaFailed*"),1,0)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![cpetterborg cpetterborg](https://community.splunk.com/legacyfs/online/avatars/125782.jpg)
cpetterborg
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
12-05-2014
08:31 AM
You can just use the string "MediaFailed" as a part of your search, something like:
source=<whatever> "MediaFailed" | stats count
That will search it matching the case.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)