Grouping Errors extracted with field extraction for to run trasform commands

[VI371887]

Hi All,

I am trying to group different errors that i have extracted to run transform commands, like stats, chart, etc.

i have extracted errors like xyzerror, abcerror, deferror, jklerror.

Now I want to be able to group them under ErrorStrings field and to be able to run something like ...

Query : index=xyz | stats count by ErrorString

So i can get count of each error string or other possible options..

I have tried them with saving whole query in eventtype =ErrorString but it doesn't help, also lookup doesn't seems to help bcuz lack of key value structure of it..

[soumyasaha25]

Hi, your requirement seems quite similar to one that i had last year.
My solution then was to save the list of error strings in a lookup file, then run the below query on it

index = abc sourcetype="xyz"
| rename _raw as rawText
| eval match_string=[|inputlookup search_string.csv |stats values(search_string) as query | eval query=mvjoin(query,",") | fields query | format "" "" "" "" "" ""]
| eval match_string=split(match_string,",")
| mvexpand match_string
| where like(rawText,"%"+match_string+"%")
| stats values(host) AS HostName count by match_string

mind you its a very heavy search query, but works fine with small data volumes. here the lookup file is saved as search_string.csv which has only one column named as "search_string".

Do let me know if this works for you. if so dont forget to hit the accept button.