Splunk Search

Get stats by error type

allladin101
Explorer

Hi,

I am trying to classify error messages based on a substring in the error message. Say suppose there are 10 errors, 3 of them have the substring "sever not reponding" to be shown in the stats as -'server error' and 5 have the substring "Timed Out" - to be shown in the stats as 'Time out error' and rest can be classified as 'others'.

Here is how i want to see the result:

error_type count

server error 3
Time out error 5
others 2

Can somebody help.

I have this basic query as of now:

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now|eval error=split(action,"error:")|eval error_type=mvindex(error,1)|stats count by error_type

above query does not work for me. 😞

0 Karma
1 Solution

pradeepkumarg
Influencer

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now | eval ERROR_TYPE= if(searchmatch("sever not reponding"), "Server Error", (if(searchmatch("Timed Out"),"Timed Out Error", "OTHER")))) | stats count by ERROR_TYPE

View solution in original post

pradeepkumarg
Influencer

index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now | eval ERROR_TYPE= if(searchmatch("sever not reponding"), "Server Error", (if(searchmatch("Timed Out"),"Timed Out Error", "OTHER")))) | stats count by ERROR_TYPE

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...