Splunk Search

Group events based on the field value

Path Finder

Hello, I want to count the number of different messages and show them in a pie chart.
My data looks like the following:

Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b59c'. | 2
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b39c'. | 3
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain='test' | 1
CreateDomainConfiguration - domain='test' | 3
CreateDomainConfiguration - domain='test' | 6
Could not contact master for new replication information | 2

Now I want to group similar events based on the field value like this:

Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID | 5
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain | 10
Could not contact master for new replication information | 2

How can I achieve this? Thanks a lot!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

This has worked for me.

...  | eval Message=case(like(Message,"An error occurred while trying to unsubscribe service with Subscription ID%"), "An error occurred while trying to unsubscribe service with Subscription ID", like(Message, "CreateDomainConfiguration - domain%"),"CreateDomainConfiguration - domain", 1=1,Message)| stats sum(Count) as Count by Message | table Message Count
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

You may want to look at the cluster command in Splunk which "groups events together based on how similar they are to each other". See more details here.

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Cluster
http://blogs.splunk.com/2014/07/28/splunk-command-cluster/

SplunkTrust
SplunkTrust

This has worked for me.

...  | eval Message=case(like(Message,"An error occurred while trying to unsubscribe service with Subscription ID%"), "An error occurred while trying to unsubscribe service with Subscription ID", like(Message, "CreateDomainConfiguration - domain%"),"CreateDomainConfiguration - domain", 1=1,Message)| stats sum(Count) as Count by Message | table Message Count
---
If this reply helps you, an upvote would be appreciated.

View solution in original post