Splunk Search

Get stats by error type

allladin101
Explorer

Hi,

I am trying to classify error messages based on a substring in the error message. Say suppose there are 10 errors, 3 of them have the substring "sever not reponding" to be shown in the stats as -'server error' and 5 have the substring "Timed Out" - to be shown in the stats as 'Time out error' and rest can be classified as 'others'.

Here is how i want to see the result:

error_type count

server error 3
Time out error 5
others 2

Can somebody help.

I have this basic query as of now:

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now|eval error=split(action,"error:")|eval error_type=mvindex(error,1)|stats count by error_type

above query does not work for me. 😞

0 Karma
1 Solution

pradeepkumarg
Influencer

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now | eval ERROR_TYPE= if(searchmatch("sever not reponding"), "Server Error", (if(searchmatch("Timed Out"),"Timed Out Error", "OTHER")))) | stats count by ERROR_TYPE

View solution in original post

pradeepkumarg
Influencer

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now | eval ERROR_TYPE= if(searchmatch("sever not reponding"), "Server Error", (if(searchmatch("Timed Out"),"Timed Out Error", "OTHER")))) | stats count by ERROR_TYPE

Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...