Splunk Search

EventStats count Function

Builder

Hello,
I'm looking to use the eventstats function to count the amount of times the word Error occurs in my event.

Can anyone help as it doesn't appear to work ?

1 Solution

Hi,

if you want to count the amount of times a word exists in a single event, i do not think eventstats can do it. You can use the stats commands for example to tell you how much events out of all your events contain the word "error".

But you can get what you want with a little combination of regex and eval. In the following run everywhere example, i counted the word hello in the field "text":

| stats count | eval text= "hello world hello my friends and so on hello." | rex field=text max_match=0 "(?<list>hello)" | eval amount=mvcount(list)

For your usecase you can change the field of the rex command to "_raw" (wich is also the default) and it should work.

Greetings

Tom

View solution in original post

Motivator
       ...  "error"| eventstats count  as number_events_error | table number_events_error
0 Karma

Builder

Hi fdi01,
We've tried this but it's not really working as we do other stuff above. Any other ideas?

0 Karma

Hi,

if you want to count the amount of times a word exists in a single event, i do not think eventstats can do it. You can use the stats commands for example to tell you how much events out of all your events contain the word "error".

But you can get what you want with a little combination of regex and eval. In the following run everywhere example, i counted the word hello in the field "text":

| stats count | eval text= "hello world hello my friends and so on hello." | rex field=text max_match=0 "(?<list>hello)" | eval amount=mvcount(list)

For your usecase you can change the field of the rex command to "_raw" (wich is also the default) and it should work.

Greetings

Tom

View solution in original post

Builder

Hi Tom,
We cannot use the stats as we want to table it later on, so we would need to use some sort of other combination.

Any ideas?

0 Karma

Motivator

Tom's suggestion doesn't use stats. Starting a search with | stats count is just a way to create a sample without any real data. Replace Tom's | stats count with your actual search string, and remove his eval text= phrase, since your data already exists. The important part in his answer is the rex:

...your search... | rex field=_raw max_match=0 "(?<list>hello)" | eval amount=mvcount(list)
0 Karma

Influencer

In this case, tom's use of stats count and the first eval are just to setup a dummy event for testing. He's suggesting that you use the following rex and eval

Correct, i edited it while you were writing this xD

0 Karma

Can you maybe post some sampledata and your search string? Because i do currently not understand why the solution should not be applicable.

If you mean because i used the stats command first, this is just to let my example run everywhere. You can also do this:

index=_internal sourcetype=splunkd | rex  max_match=0 "(?<list>size)" | eval amount=mvcount(list) | table _raw amount

Which counts the word "size" per event in your splunkd logs.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!