Splunk Search
Highlighted

Count Occurrence of string from raw log

Explorer

I am trying to count occurrences of events from raw logs. Basically, if the log contains the string "MediaFailed", then count it. The difficulty is this string is not part of a key-value pair so I can't do an equality statement. I'm just looking for its existence within the entire log. I have tried the following, unsuccessfully:

| eval failures=case(match(_raw,"MediaFailed"),uuid)

Any help is appreciated!

Tags (3)
0 Karma
Highlighted

Re: Count Occurrence of string from raw log

SplunkTrust
SplunkTrust

You can just use the string "MediaFailed" as a part of your search, something like:

source=<whatever> "MediaFailed" | stats count

That will search it matching the case.

0 Karma
Highlighted

Re: Count Occurrence of string from raw log

SplunkTrust
SplunkTrust

Something like this would work?

| eval failures=if(match(_raw,"*MediaFailed*"),1,0)
0 Karma