Splunk Search

Help with splunk query, searchmatch finding false positives

hamishcross
Engager

Hey All,

Very new to using splunk and love the power of dashboards.

I'm executing the following

index=my_app ("C4C Auth Scenario")| stats count(eval(searchmatch("C4C Auth Scenario 1"))) as "S1", count(eval(searchmatch("C4C Auth Scenario 2"))) as "S2", count(eval(searchmatch("C4C Auth Scenario 3"))) as "S3", count(eval(searchmatch("C4C Auth Scenario 4Y"))) as "S4Y", count(eval(searchmatch("C4C Auth Scenario 4N"))) as "S4N", count(eval(searchmatch("C4C Auth Scenario 5"))) as "S5", count(eval(searchmatch("C4C Auth Scenario 6"))) as "S6" | untable blank Reason Count | table Reason Count

And I'm finding that S6 is returning false positives.

If I execute index=my_app "C4C Auth Scenario 6" no results are returned.

Yet if I execute the full query above, it returns multiple rows in the count

What would the cause of this be, and how do I go about ensuring it doesn't occur.

I'm looking to create a dashboard based on the occurrence of logging events.

Any help would be greatly appreciated.

0 Karma
1 Solution

FrankVl
Ultra Champion

I don't have an immediate answer for the difference in search results and the 'false positives' you experienced. Are you sure both searches were ran over the same time window?

Anyway, I would solve this by extracting the scenario 'number' into a field and then doing a stats by that field.

For example (you want to implement this with automatic field extractions in the end, so you don't need the line with the rex command anymore):

index=my_app ("C4C Auth Scenario")
| rex "C4C Auth Scenario (?<Reason>\w+)"
| stats count by Reason

View solution in original post

FrankVl
Ultra Champion

I don't have an immediate answer for the difference in search results and the 'false positives' you experienced. Are you sure both searches were ran over the same time window?

Anyway, I would solve this by extracting the scenario 'number' into a field and then doing a stats by that field.

For example (you want to implement this with automatic field extractions in the end, so you don't need the line with the rex command anymore):

index=my_app ("C4C Auth Scenario")
| rex "C4C Auth Scenario (?<Reason>\w+)"
| stats count by Reason

hamishcross
Engager

Thanks mate, that worked pretty well. Only thing I would say is I had to remove the "index=my_app" after rex to make it work. Was this in error or have I made a mistake?

0 Karma

FrankVl
Ultra Champion

Oh, yeah, copy paste mistake. Let me update it to prevent confusion if someone else reads this in the future 🙂

0 Karma

hamishcross
Engager

Awesome! For newbies like me, if it doesn't work, finding the problem can be really problematic. So really good to ensure the examples work. Thanks again

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...