Splunk Search

Get different message Counts from the same field

Murali51
Explorer

Hello @richgalloway , I am asking your help again to get counts for below messages. I tried the same instruction but unable to get counts. From below messages get counts depends and message value. Your help would be highly appreciated. 

Consider message which ends with To Report. and get counts.

message contains "Parker could not be processed" - Failure count

message contains "Parker successfully issued" - Success Count

message contains "System exception.Parker Exception Occurred " - System exception Count

if message has Any other message : Partial Success

get total count Total Count.

PK11036791 : Parker successfully issued the 06/05/2021 renewal.,.To Report.
PK11036918 : Parker successfully issued the 06/05/2021 renewal.,.To Report.
PK11037082 : Parker successfully issued the 06/05/2021 renewal.,.To Report.
PK01041601 : New activity on DRA for Michael Demiranda.,Please review new MVR information.,New PPA changes present.,Multiple Property policies present, please work HO.,.To Report.
PK11032274 : Please review new MVR information.,.To Report.
PK11036998 : Parker successfully issued the 06/05/2021 renewal.,.To Report.
PK11041586 : New HO changes present.,Please review new MVR information.,New PPA changes present.,.To Report.
PK11004163 : New HO changes present.,New PPA changes present.,.To Report.
PK11014724 : New PPA changes present.,.To Report.
PK11041665 : New HO changes present.,Please review new MVR information.,New PPA changes present.,.To Report.
Parker could not be processed, please work PK Renewal. To Report.
System exception.Parker Exception Occurred : Unable to extract Pending Renewal policy period for PK Policy. at Source: Invoke Workflow File: Get Data: Throw
System exception.Parker Exception Occurred : Index and length must refer to a location within the string. Parameter name: length at Source: Invoke Workflow File: Make Decision: Throw
Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Murali51,

Only changing last case value should help, please try below;

index=main host=brprwbpa001 robotJobName=Parker ("System Exception" OR "To Report.")
| eval Message=case(like(Message,"%Parker successfully%"), "Successful Count", like(Message, "Parker could not be processed, please work PK Renewal.%"), "Exception Count", like(Message, "System exception%"), "System exception Count", 1==1, "Partial Success") 
| stats count by Message 
| addcoltotals label="Total Count" labelfield=Message
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Murali51
Explorer

Hi @richgalloway when you get a chance can you please look into my query, thanks. 

0 Karma

Murali51
Explorer

I have tried below query and didn't work. 

 

index=main host=brprwbpa001 robotJobName=Parker ("System Exception" OR "To Report.") | eval Message=case(like(Message,"%Parker successfully%"), "Successful Count", like(Message, "Parker could not be processed, please work PK Renewal.%"), "Exception Count", like(Message, "System exception%"), "System exception Count", 1==1, Message)| stats count by Message| addcoltotals label="Total Count" labelfield=Message

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...