Splunk Search

Count of occurence of string

aditya22
New Member

Hi,

I am trying to get the occurence of two strings for every 3 minute interval.Tried this.

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" | timechart span=3m count(eval(match(_raw,"rapidViewId="))) AS board, count(eval(match(_raw,"/user/mention"))) AS mention

I am getting the result in intended format.But on checking the events for eg:rapidViewId= I can see the events are mix of both(rapidViewId and /user/mention).

Any idea what i am doing wrong?.I need individual count in every 3 minutes.

Labels (2)
Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @aditya22,

Try the following search :

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" 
| eval chartingField=case(match(_raw,"rapidViewId="),"board", match(_raw,"/user/mention"), "mention")
| timechart span=3m count by chartingField

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @aditya22,

Try the following search :

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" 
| eval chartingField=case(match(_raw,"rapidViewId="),"board", match(_raw,"/user/mention"), "mention")
| timechart span=3m count by chartingField

Cheers,
David

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...