Splunk Search

Crossing multivalued fields

Caio_Santos
Path Finder

Got the following: One field with 4 types of values/functions and another field that is the status of those functions such as INFO or ERROR.

I would like to cross this information to see each function how many ERROS or INFOs those got. I was wondering if I could do this task with stats, but the search command bellow is so far what i could get.

index="websphere_index" sourcetype="portoprint-app-*"
| rex "(?m)^\[.*\]\[.*\]\s+?(?<WEB_STATUS>([A-Z]+))\s+?[\w\.]+\s+?\[.*\]\s+?\w+\(\)"
| rex "(?m)^\[.*\]\[.*\]\s[A-Z]+(\s+?|\S+?).*\1\[.*\]\s(?<WEBSPHERE_FUNCTION>(\w+\(\)))"
| stats count(WEB_STATUS) by WEBSPHERE_FUNCTION

Thanks!

Tags (2)
0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Instead of stats, try chart, like:

... | chart count by WEBSPHERE_FUNCTION WEB_STATUS

Or you could do:

... | stats count by WEBSPHERE_FUNCTION WEB_STATUS

View solution in original post

Stephen_Sorkin
Splunk Employee
Splunk Employee

Instead of stats, try chart, like:

... | chart count by WEBSPHERE_FUNCTION WEB_STATUS

Or you could do:

... | stats count by WEBSPHERE_FUNCTION WEB_STATUS

Caio_Santos
Path Finder

Exactly what I wanted ! Thank you

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...