Splunk Search

How do I consolidate the count of similar values in a table?

jonathanoberhau
New Member

I have a Search that looks at some XML responses from an API and should create a time chart by the count of each type of error message.

I have a query that produces that result, but the issue I have is the transaction deadlock errors all represent the same type of error, but show as distinct columns since they have a unique "Process ID".

alt text

What I would like to do is consolidate the various Transaction Deadlock columns into one column and have the total count of all deadlock errors.

Query thus far:

index=my_favorite_index  "message.location"="cancelContract"
| spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
| mvexpand ResponseMessages
| spath input=ResponseMessages
| timechart count by Text

Anyone have any ideas on how to accomplish this?

Tags (3)
0 Karma
1 Solution

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

View solution in original post

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

jonathanoberhau
New Member

I had to add the closing parenthesis for the like() function, then it worked great!

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...