Splunk Search

How can I refine this search string to grab those for the whole year and add other Splunk commands to break them into common ‘buckets’ with counts for each type of error without duplicate error types?

belamg
New Member

How can I refine this search string to grab those for the whole year and add other Splunk commands to break them into common ‘buckets’ with counts for each type of error without duplicate error types?

sourcetype=was_prod source="*/srs/Automation" "error"

0 Karma

DavidHourani
Super Champion

Hi @belamg,

First to search over one year make sure your time picker is set to one year or if you wish to have the filters in your search then use the following :

earliest=-1y latest=now()

Then, to get your count per error type your search becomes like this :

sourcetype=was_prod source="*/srs/Automation" "error"   earliest=-1y latest=now() 
| stats count by errorType

Make sure the error types are extracted in a field called errorType so you can run the stats command.

Cheers,
David

0 Karma

Sukisen1981
Champion

hi @belamg - This is a rather vague question.
When you add a string like "error" to your search, by default it will pick up all occurrences of the string 'error' if they are present in your _raw events.
can you give an example of your raw events with error and what is your expected output?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...