Splunk Search

How do I consolidate the count of similar values in a table?

jonathanoberhau
New Member

I have a Search that looks at some XML responses from an API and should create a time chart by the count of each type of error message.

I have a query that produces that result, but the issue I have is the transaction deadlock errors all represent the same type of error, but show as distinct columns since they have a unique "Process ID".

alt text

What I would like to do is consolidate the various Transaction Deadlock columns into one column and have the total count of all deadlock errors.

Query thus far:

index=my_favorite_index  "message.location"="cancelContract"
| spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
| mvexpand ResponseMessages
| spath input=ResponseMessages
| timechart count by Text

Anyone have any ideas on how to accomplish this?

Tags (3)
0 Karma
1 Solution

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

View solution in original post

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

jonathanoberhau
New Member

I had to add the closing parenthesis for the like() function, then it worked great!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...