How to analysis the occurrence of an ERROR on a give field with some other field?

[brober27]

I have a log, and in theis log I have a field that I have called Informative. This Informative can assume the following values : INFO, WARNING, ERROR, DEBUG.
My question is : how can I analyse the occurrence of the value ERROR in theis field with some other fiel value?
Should I use correlat, associate, contingency command? or something else?
How to misure the degree of cooccurence between the value ERROR and something else to discover some causes?
PLEASE HELP ME!
Thank BYe

[MousumiChowdhur]

Hi brober27,

It would be better if you can provide sample logs to provide you with exact query but meanwhile you can take the reference of the below query to identify the error message with that specific error in your log. The below query is specifically for ERROR from splunk internal log.

index=_internal log_level=ERROR | rex "(ERROR)\s+(?P<ErrorMessage>.*)" | stats count by log_level ErrorMessage

You can add your own index name, rex and log level field name in the above search query.

[deepashri_123]

Hi brober27,

Do u want to check the count of events with specific condition AS ERROR AND say X together?
In that case your query can be something like this:
index=* (ERROR AND X) | stats count

Let me know if this helps!!

[brober27]

No. This way you must fix the value of X. You do not know a priori a value or a field. What I want is a result which report me the most probable cooccurrence field values.
Thank