Splunk Search

Count of occurence of string

aditya22
New Member

Hi,

I am trying to get the occurence of two strings for every 3 minute interval.Tried this.

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" | timechart span=3m count(eval(match(_raw,"rapidViewId="))) AS board, count(eval(match(_raw,"/user/mention"))) AS mention

I am getting the result in intended format.But on checking the events for eg:rapidViewId= I can see the events are mix of both(rapidViewId and /user/mention).

Any idea what i am doing wrong?.I need individual count in every 3 minutes.

Labels (2)
Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @aditya22,

Try the following search :

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" 
| eval chartingField=case(match(_raw,"rapidViewId="),"board", match(_raw,"/user/mention"), "mention")
| timechart span=3m count by chartingField

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @aditya22,

Try the following search :

index=xyz host="hostname" "rapidViewId=" OR "/user/mention" 
| eval chartingField=case(match(_raw,"rapidViewId="),"board", match(_raw,"/user/mention"), "mention")
| timechart span=3m count by chartingField

Cheers,
David

Get Updates on the Splunk Community!

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...