Handle different search results as one by analysing the percentage match

[mmsbswe]

Hi Community,

i have a search which shows me all PHP-Errors in the configured timespan. Now i want so sort this results by matching diffs other results in percent and show results over X% matching results as one.

For instance:

Search Query:

index=php source="/var/log/docker/php-fpm/error.log" "PHP Fatal error"

Example result 1:

[13-Aug-2019 03:01:29 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
/usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfiguration.php(10): require_once()

Example result 2:

[12-Aug-2019 17:01:01 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:12
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/EnvironmentPilot.php(41): include()

Field extractions are very useful but the most php-fpm-errors are very different in their appearance.

Now i want a output like this instead of two results :

PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
....

Thanks in advance for checking my question!

[Sukisen1981]

so you extract using a rgeex from PHP Fatal error: Uncaught Error: to end of line or to just before Stack trace: is encountered in the log.
Then you look at how many distinct such extractions you get and calculate percentages based on the counts.
Is this what you are looking for?

[mmsbswe]

Hi, i will try it. Thanks!