Splunk Search

Help with Search string count

D01033778
New Member

I am trying to extract a string, count how many times it appears and group it by host.

RAW LOG:

[2013-01-31T03:55:06.739-06:00] [soa_server2] [ERROR] [] [oracle.soa.bpel.engine.dispatch] [tid: orabpel.invoke.pool-4.thread-16] [userId: ] [ecid: b5e97102d2ab8130:-37493125:13c69c08931:-8000-00000000003946d4,0] [APP: soa-infra] failed to handle message[[ORABPEL-09705 Could not initialize variable.An error occurs while initializing BPEL variable inputVariable; the schema processor cannot find the element


Search Expression:

host="stiint2app2" OR host="stiint2app1" | chart count(ORABPEL-05002) AS ERROR:ORABPEL-05002,
count(ORABPEL-09705) AS ERROR:ORABPEL-09705,
count(ORABPEL-35009) AS ERROR:ORABPEL-35009,
count(ORABPEL-9732) AS ERROR:ORABPEL-9732 by host


Results:

host ERROR:ORABPEL-05002 ERROR:ORABPEL-09705 ERROR:ORABPEL-35009 ERROR:ORABPEL-9732



1 stiint2app1 0 0 0 0

2 stiint2app2 0 0 0 0

Currently I am not getting the exact results that I am looking for. Example I have actual count of 37 occurences for ORABPEL-09705, today but my results show 0.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Your syntax seems to a bit off. By the looks of it, it seems that you're assuming that count(blah) will match the raw log for "blah" and return the count of events where a match was found. This is not the case. count(blah) will count how many events the FIELD "blah" exists in. If you want to match something against the raw event, you'll want to do count(eval(searchmatch("blah"))).

So, with the query rewritten with those changes, it'll look something like

host="stiint2app2" OR host="stiint2app1" | chart count(eval(searchmatch("ORABPEL-05002"))) AS ERROR:ORABPEL-05002, count(eval(searchmatch("ORABPEL-09705"))) AS ERROR:ORABPEL-09705, count(eval(searchmatch("ORABPEL-35009"))) AS ERROR:ORABPEL-35009, count(eval(searchmatch("ORABPEL-9732"))) AS ERROR:ORABPEL-9732 by host

Personally I would go for a somewhat different approach - create a field extraction that matches the individual error ID's after the "ORABPEL-" string, so a field would be created (calling it ORABPEL seems appropriate) holding the various error ID's. Having done that, just doing

host="stiint2app2" OR host="stiint2app1" | chart count by ORABPEL,host

would suffice.

View solution in original post

stefandagerman
Path Finder

Are the arguments to the count() function field names or strings?

0 Karma

Ayn
Legend

Your syntax seems to a bit off. By the looks of it, it seems that you're assuming that count(blah) will match the raw log for "blah" and return the count of events where a match was found. This is not the case. count(blah) will count how many events the FIELD "blah" exists in. If you want to match something against the raw event, you'll want to do count(eval(searchmatch("blah"))).

So, with the query rewritten with those changes, it'll look something like

host="stiint2app2" OR host="stiint2app1" | chart count(eval(searchmatch("ORABPEL-05002"))) AS ERROR:ORABPEL-05002, count(eval(searchmatch("ORABPEL-09705"))) AS ERROR:ORABPEL-09705, count(eval(searchmatch("ORABPEL-35009"))) AS ERROR:ORABPEL-35009, count(eval(searchmatch("ORABPEL-9732"))) AS ERROR:ORABPEL-9732 by host

Personally I would go for a somewhat different approach - create a field extraction that matches the individual error ID's after the "ORABPEL-" string, so a field would be created (calling it ORABPEL seems appropriate) holding the various error ID's. Having done that, just doing

host="stiint2app2" OR host="stiint2app1" | chart count by ORABPEL,host

would suffice.

D01033778
New Member

Thanks for much. The first example works like a charm. I will look into creating the field extraction as well.

Thanks Again.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...