Splunk Search

Find count of "failures" in events

navd
New Member

I am running the following query , which is returning the number of events where "failures" keyword is occuring , but how can I find how many times "failures" keyword occured in each event

index=abc "failures"|stats count by host|eventstats sum(count) as totalCount

Tags (1)
0 Karma

pruthvikrishnap
Contributor

Hey Navd,
based on the scenario this search might work.
Do let me know if this is helping you.

index=abc sourcetype=xyz "failures"| rex max_match=0 "(?P<term>failures)" 
 | eval count=mvcount(term) 
 | stats sum(count) as Total by term
0 Karma

Ayn
Legend

You can do this by extracting all occurrences of the string "failures" to a field and then count all instances of that field:

index=abc "failures" | rex max_match=0 "(?<failures>failures)" | stats count(failures)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...