Splunk Search

How do I consolidate the count of similar values in a table?

jonathanoberhau
New Member

I have a Search that looks at some XML responses from an API and should create a time chart by the count of each type of error message.

I have a query that produces that result, but the issue I have is the transaction deadlock errors all represent the same type of error, but show as distinct columns since they have a unique "Process ID".

alt text

What I would like to do is consolidate the various Transaction Deadlock columns into one column and have the total count of all deadlock errors.

Query thus far:

index=my_favorite_index  "message.location"="cancelContract"
| spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
| mvexpand ResponseMessages
| spath input=ResponseMessages
| timechart count by Text

Anyone have any ideas on how to accomplish this?

Tags (3)
0 Karma
1 Solution

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

View solution in original post

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

jonathanoberhau
New Member

I had to add the closing parenthesis for the like() function, then it worked great!

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...