Displaying 2 counts (error and total)

[shashankjuloori]

There is a requirement in which i need to display total count and errors(in total count). error message is in raw text.

[richgalloway]

Vague questions beget vague answers. @woodcock has the general idea. We must leave it to you to figure out how to extract the error text from each message since we don't have enough information about the structure of the messages.

[woodcock]

Like this:

... | rex to create error_text
| stats dc(error_text) AS "error count" count AS "total count" by foundation
| eventstats sum('total count') AS "grand total count"

[darrenfuller]

Hi shashankjuloori.

Not a lot to go on here. is the error message extracted in a field or only in _raw? Can you share an event or two of sample data to help out a bit|?

./d

[shashankjuloori]

error message has to be extracted from raw text. Then i need to display total events count and error events count.

[richgalloway]

Still not enough to work with. Please provide some sample events (mask private data) and desired output.

[shashankjuloori]

field1= || field2= || field3= || message------------error text ----------/message
this is the error message structure.

here i need to separate the events which contains error text, suppose it to be errors and display both total count and error count.

[to4kawa]

we can extract error text and message
but, isn't these actual logs?

[shashankjuloori]

Sorry, i cant paste the logs due to security reasons.
Events are logged based on the field foundation, suppose A, B, C.
and logs will be like

index=* Foundation=A | field1 | field2| ...message......errortest.../message
index=* Foundation=A | field1 | field2| ...message......errortest.../message
index=* Foundation=B | field1 | field2| ...message......errortest.../message
index=* Foundation=C | field1 | field2| ...message......errortest.../message

here i need to segregate the events based on the error text and total count, and the output should be like

Foundation        |  error count   | total count
   A            count             count
   B            count             count
   C            count            count

and i am sorry for messing up the things.

[woodcock]

I updated my vague answer.

[shashankjuloori]

Thanks for the help.