Help with stats needed

[damucka]

Hello,

I have following search:

index=mlbso sourcetype=*_abaptraces (( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND ERROR ) OR ERROR 
earliest=-5h@h latest=@h  

| eval filename=source
| eval hostname=host
| eval SID=substr(sourcetype,1,3)

Now I would like to get the statistics / table with the following counts:

SID, host, total_err_count, mmx_err_count, mtx_err_count, .... etc.

To clarify, the strings of mmx, ERROR, mtx, etc. can occur several times in a single event, however I would like to count such event only one time.

Could you please advice?

Kind Regards,
Kamil

The

[gcusello · Accepted solution]

Hi damucka,
did you explore the stats command ( https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Stats )?

Anyway, try something like this:

 index=mlbso sourcetype=*_abaptraces ((( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND ERROR ) OR ERROR) earliest=-5h@h latest=@h  
| rename source AS filename host AS hostname
| eval SID=substr(sourcetype,1,3)
| stats count(total_err_count) AS total_err_count dc(mmx_err_count) AS mmx_err_count count(mtx_err_count) AS mtx_err_count BY SID host

You also should explore the functions to use in stats (count, dc, sum, avg, etc...), to choose the ones you need (e.g. dc for mmx).

Ciao.
Giuseppe

[damucka]

Thank you.
I managed to get what I want from the stats point of view ... but I noticed that I need to exclude some search strings, like e.g. the word "error" small letters I do not want. I tried to use CASE in my search, but it does not work. Here the current search:

index=mlbso sourcetype=isp_abaptraces ((( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND CASE( ERROR ) ) OR CASE( ERROR ) OR CASE(Error ) )
earliest=-1h@h latest=@h  
 | eval SID=substr(sourcetype,1,3)
 | stats count AS Total count(eval(searchmatch("ERROR"))) AS err_cnt
    count(eval(searchmatch("*MTX*"))) AS mtx_cnt
    count(eval(searchmatch("*MMX*"))) AS mmx_cnt
    by SID host

Do I missunderstand the concept of CASE?

Kind Regards,
Kamil

[gcusello]

Hi damucka,
the easiest way is to use a regex that's case sensitive:

 index=mlbso sourcetype=isp_abaptraces (( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) Error) ) earliest=-1h@h latest=@h  
| regex _raw!="error"
| eval SID=substr(sourcetype,1,3)
| stats count AS Total count(eval(searchmatch("ERROR"))) AS err_cnt
     count(eval(searchmatch("*MTX*"))) AS mtx_cnt
     count(eval(searchmatch("*MMX*"))) AS mmx_cnt
     by SID host

Ciao.
Giuseppe