Splunk Search

Handle different search results as one by analysing the percentage match

Engager

Hi Community,

i have a search which shows me all PHP-Errors in the configured timespan. Now i want so sort this results by matching diffs other results in percent and show results over X% matching results as one.

For instance:

Search Query:

index=php source="/var/log/docker/php-fpm/error.log" "PHP Fatal error"

Example result 1:

[13-Aug-2019 03:01:29 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
/usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfiguration.php(10): require_once()

Example result 2:

[12-Aug-2019 17:01:01 Europe/Berlin] PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:12
Stack trace:
#0 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/EnvironmentPilot.php(41): include()

Field extractions are very useful but the most php-fpm-errors are very different in their appearance.

Now i want a output like this instead of two results :

PHP Fatal error:  Uncaught Error: Call to a member function fetch_assoc() on boolean in 
 /usr/share/nginx/current/typo3-web/web/typo3conf/AdditionalConfigurations/overrideSettings.php:22
....

Thanks in advance for checking my question!

0 Karma

Champion

so you extract using a rgeex from PHP Fatal error: Uncaught Error: to end of line or to just before Stack trace: is encountered in the log.
Then you look at how many distinct such extractions you get and calculate percentages based on the counts.
Is this what you are looking for?

Engager

Hi, i will try it. Thanks!

0 Karma