I have two queries:
1. index=A sourcetype=B "ERROR_A" | rex field=_raw "loginid (?<login_id>\d+) ::" | deduploginid | tableloginid
o/p eg::
123
456
789
2. index=A sourcetype=B "ERROR_B" | rex field=_raw "loginid (?<login_id>\d+) ::" | dedup loginid | table loginid
o/p eg::
878
123
456
Query 1 finds all the login ID which failed because of ERROR_A and Query 2 finds all the login ID which failed because of ERROR_B. I want to find all the loginId which failed because of both ERROR_A and ERROR_B.SO expected result from above is
123
456
How can I combine both these queries given the the loginid is a extract field from raw logs.?
index=A sourcetype=B "ERROR_A" OR "ERROR_B"
| rex "(?<errortype>ERROR_A|ERROR_B)"
| rex field=_raw "loginid (?<login_id>\d+) ::"
| stats count by login_id errortype
| stats count by login_id
| where count = 2
Give this a try
index=A sourcetype=B "ERROR_A" OR "ERROR_B"
| rex field=_raw "loginid (?<login_id>\d+) ::"
| eval Error=if(searchmatch("ERROR_A"), "ERROR_A" ,"ERROR_B" )
| stats dc(Error) as Errors by loginid | where Errors=2
| tableloginid
I will try and update. May I know that in the expression :
| eval Error=if(searchmatch("ERROR_A"), "ERROR_A" ,"ERROR_B" )
Why have we put only ERROR_A in searchmatch clause ?
index=A sourcetype=B "ERROR_A" OR "ERROR_B"
| rex "(?<errortype>ERROR_A|ERROR_B)"
| rex field=_raw "loginid (?<login_id>\d+) ::"
| stats count by login_id errortype
| stats count by login_id
| where count = 2
Testing.Will update once i ran this.