Splunk Search

How to count number of occurrences of string in single event and group as per count ?

splunkDevendra
Explorer

 

I want to find out How many times string appeared in ONE SINGLE EVENT.
and group all the events and find table like :

Attempts        : Count :
1                            100
2                            342
3                            201
4                            04
5                            00

how to write query for this ?


Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Here is an example of how you can count the number of attempts.aggrStatus elements in each object

| makeresults
| eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}"
| rex field=_raw "objectA\":(?<json>.*)"
| spath input=json
| eval attempts=mvcount('attempts{}.aggrStatus')

assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.

Then you just need to add the following to your search to get the counts

| stats count by attempts
| sort attempts

 

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

splunkDevendra
Explorer

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?

0 Karma

splunkDevendra
Explorer

found following working 

 

| stats count as Count by attempts
| eventstats sum(Count) as Total
| eval perc=round((Count/Total)*100,2)
| fields - Total
| sort 0 - Count
| head 10

0 Karma

splunkDevendra
Explorer

How to minus one attempt from final table as it counts 1 extra attempt in every event

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval attempts=mvcount(status)-1
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...