Splunk Search

How to analysis the occurrence of an ERROR on a give field with some other field?

brober27
New Member

I have a log, and in theis log I have a field that I have called Informative. This Informative can assume the following values : INFO, WARNING, ERROR, DEBUG.
My question is : how can I analyse the occurrence of the value ERROR in theis field with some other fiel value?
Should I use correlat, associate, contingency command? or something else?
How to misure the degree of cooccurence between the value ERROR and something else to discover some causes?
PLEASE HELP ME!
Thank BYe

Tags (1)
0 Karma

MousumiChowdhur
Contributor

Hi brober27,

It would be better if you can provide sample logs to provide you with exact query but meanwhile you can take the reference of the below query to identify the error message with that specific error in your log. The below query is specifically for ERROR from splunk internal log.

index=_internal log_level=ERROR | rex "(ERROR)\s+(?P<ErrorMessage>.*)" | stats count by log_level ErrorMessage

You can add your own index name, rex and log level field name in the above search query.

0 Karma

deepashri_123
Motivator

Hi brober27,

Do u want to check the count of events with specific condition AS ERROR AND say X together?
In that case your query can be something like this:
index=* (ERROR AND X) | stats count

Let me know if this helps!!

0 Karma

brober27
New Member

No. This way you must fix the value of X. You do not know a priori a value or a field. What I want is a result which report me the most probable cooccurrence field values.
Thank

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...