Splunk Search

Crossing multivalued fields

Path Finder

Got the following: One field with 4 types of values/functions and another field that is the status of those functions such as INFO or ERROR.

I would like to cross this information to see each function how many ERROS or INFOs those got. I was wondering if I could do this task with stats, but the search command bellow is so far what i could get.

index="websphere_index" sourcetype="portoprint-app-*"
| rex "(?m)^\[.*\]\[.*\]\s+?(?<WEB_STATUS>([A-Z]+))\s+?[\w\.]+\s+?\[.*\]\s+?\w+\(\)"
| rex "(?m)^\[.*\]\[.*\]\s[A-Z]+(\s+?|\S+?).*\1\[.*\]\s(?<WEBSPHERE_FUNCTION>(\w+\(\)))"
| stats count(WEB_STATUS) by WEBSPHERE_FUNCTION

Thanks!

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Instead of stats, try chart, like:

... | chart count by WEBSPHERE_FUNCTION WEB_STATUS

Or you could do:

... | stats count by WEBSPHERE_FUNCTION WEB_STATUS

View solution in original post

Splunk Employee
Splunk Employee

Instead of stats, try chart, like:

... | chart count by WEBSPHERE_FUNCTION WEB_STATUS

Or you could do:

... | stats count by WEBSPHERE_FUNCTION WEB_STATUS

View solution in original post

Path Finder

Exactly what I wanted ! Thank you

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!