I am trying to extract a certain error and then plot in on an are chart using rex. Below is the error I am looking for in logs :
Error : Request processing failed; nested exception is com.unionbank.banking.exception.BankingRuntimeException: HRTMap : HRTMap
The query I am using is :
index=xxx host=*prd* source= *yyy* "HRTMap" | eval Date=strftime(_time, "%m-%d-%Y") | eval Time=strftime(_time, "%H:%M:%S") |rex "HRTMap: (?\w+)" | timechart count(HRTMapError) as HRT
but I am not getting a result for that.
Try this:
index=xxx host=prd source= yyy "HRTMap" | eval Date=strftime(_time, "%m-%d-%Y") | eval Time=strftime(_time, "%H:%M:%S") |rex "HRTMap\s*:\s*(?<HRTMapError>\w+)" | timechart count(HRTMapError) as HRT
You can also use |timechart dc(HRTMapError) as HRT
to get the distinct count of error messages.
Hope it helps
Try this:
index=xxx host=prd source= yyy "HRTMap" | eval Date=strftime(_time, "%m-%d-%Y") | eval Time=strftime(_time, "%H:%M:%S") |rex "HRTMap\s*:\s*(?<HRTMapError>\w+)" | timechart count(HRTMapError) as HRT
You can also use |timechart dc(HRTMapError) as HRT
to get the distinct count of error messages.
Hope it helps