Hi,
I'm new to Splunk and I would like to get top errors on a table, but the external API returns a stack tracing making it difficult to work on it.
I'm trying to make a regex that groups those errors by error code "*Return code: [<code>]*"( letting it work with other errors), than count it.
Could you help me, please? 🥺
Hi @gcusello, thanks for the suggestion
I used Rex to create a new field with return code, then stats to count and show similar errors
...
| rex field=Response.body.Result "(?<code>(Return code: \[\d+]|null))"
| stats first(Response.body.Result) as Logs count(code) as Events
| table Logs, Events
Hi @haist,
if you need help in regex creation, you should share some log examples.
If instead you need help in search, you have to follow these steps:
index=your_index code IN ("error1","error2","error3")
| stats values(host) AS host earliest(_time) AS earliest latest(_time) AS latest count BY code
| eval
earliest=strftime(earliest,"%Y-%m-%d %H:%M:%S"),
latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
Ciao.
Giuseppe
Hi @gcusello, thanks for the suggestion
I used Rex to create a new field with return code, then stats to count and show similar errors
...
| rex field=Response.body.Result "(?<code>(Return code: \[\d+]|null))"
| stats first(Response.body.Result) as Logs count(code) as Events
| table Logs, Events
Hi @haist,
ok, I don't understand where you are taking the field "counter" that it's in teh table command but it isn't in the stats command.
Remember that after a stats command you have only the fields expressed in the stats command, in your case only "Logs" and "Events", not "counter"!
Anyway, if my answer solves your problem, please accept it for the other people of Community, otherwise, tell me how can I help you.
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉
That's true, I was generalizing and translating the names and mismatched here, thanks for attention 😀