Splunk Search

How to count events from a same file with having two different raw text ?

m7787580
Explorer

Hi Splunker,

I have to count success and failure count from the same index and sourcetype on the basis of raw text in an event.
Only difference is that for success raw text is different and for failure raw text is different.

I have used below logic to find count of success and failure but this query is taking loads of time to execute.

Please remember these strings present below are not any field in Splunk it's a simple text on the basis of that i need to filter and count.

Could you please suggest me some other way by which i can execute this query faster.

index=Only_prod host=winter-p*-1 sourcetype="Season.log"
(Incoming OR Outgoing)
NOT ("Some String One" ) ("Some String Two" OR "Some String Three" OR "Some String Four")
|stats count as Error

|Join serviceName type=outer [
search index=Only_prod host=winter-p*-1 sourcetype="Season.log"
(Incoming OR Outgoing)
NOT ("Some String Five" ) ("Some String Seven" OR "Some String Six" OR "Some String Eight")
| stats count as Successes ]

Thanks in Advance
Regards,

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi m7787580,
try something like this:

(index=Only_prod host=winter-p*-1 sourcetype="Season.log" (Incoming OR Outgoing) NOT ("Some String One" ) ("Some String Two" OR "Some String Three" OR "Some String Four")) OR (index=Only_prod host=winter-p*-1 sourcetype="Season.log" (Incoming OR Outgoing) NOT ("Some String Five" ) ("Some String Seven" OR "Some String Six" OR "Some String Eight"))
| eval status=case(searchmatch("Some String Two"),"Error",searchmatch("Some String Three"),"Error",searchmatch("Some String Four"),"Error",searchmatch("Some String Seven"),"Success",searchmatch("Some String Six"),"Success",searchmatch("Some String Eight"),"Success")
| stats count BY status

In few words: put in OR both your searches and, using eval, give a status to each event, then you can use stats command.

Bye.
Giuseppe

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try.

index=Only_prod host=winter-p*-1 sourcetype="Season.log"
(Incoming OR Outgoing) 
(NOT ("Some String One" ) ("Some String Two" OR "Some String Three" OR "Some String Four")) OR NOT ("Some String Five" ) ("Some String Seven" OR "Some String Six" OR "Some String Eight")
| eval Success=if(searchmatch("NOT (\"Some String One\" ) (\"Some String Two\" OR \"Some String Three\" OR \"Some String Four\""),1,0) | eval Error=abs(Success-1)
|stats sum(Error) as Errors sum(Success) as Successes
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...