Splunk Search

How to analysis the occurrence of an ERROR on a give field with some other field?

brober27
New Member

I have a log, and in theis log I have a field that I have called Informative. This Informative can assume the following values : INFO, WARNING, ERROR, DEBUG.
My question is : how can I analyse the occurrence of the value ERROR in theis field with some other fiel value?
Should I use correlat, associate, contingency command? or something else?
How to misure the degree of cooccurence between the value ERROR and something else to discover some causes?
PLEASE HELP ME!
Thank BYe

Tags (1)
0 Karma

MousumiChowdhur
Contributor

Hi brober27,

It would be better if you can provide sample logs to provide you with exact query but meanwhile you can take the reference of the below query to identify the error message with that specific error in your log. The below query is specifically for ERROR from splunk internal log.

index=_internal log_level=ERROR | rex "(ERROR)\s+(?P<ErrorMessage>.*)" | stats count by log_level ErrorMessage

You can add your own index name, rex and log level field name in the above search query.

0 Karma

deepashri_123
Motivator

Hi brober27,

Do u want to check the count of events with specific condition AS ERROR AND say X together?
In that case your query can be something like this:
index=* (ERROR AND X) | stats count

Let me know if this helps!!

0 Karma

brober27
New Member

No. This way you must fix the value of X. You do not know a priori a value or a field. What I want is a result which report me the most probable cooccurrence field values.
Thank

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...