Splunk Search

How to count number of occurrences of string in single event and group as per count ?

splunkDevendra
Explorer

 

I want to find out How many times string appeared in ONE SINGLE EVENT.
and group all the events and find table like :

Attempts        : Count :
1                            100
2                            342
3                            201
4                            04
5                            00

how to write query for this ?


Labels (4)
0 Karma
1 Solution

ITWhisperer
Legend
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

View solution in original post

bowesmana
Super Champion

Here is an example of how you can count the number of attempts.aggrStatus elements in each object

| makeresults
| eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}"
| rex field=_raw "objectA\":(?<json>.*)"
| spath input=json
| eval attempts=mvcount('attempts{}.aggrStatus')

assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.

Then you just need to add the following to your search to get the counts

| stats count by attempts
| sort attempts

 

ITWhisperer
Legend
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

View solution in original post

splunkDevendra
Explorer

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?

0 Karma

splunkDevendra
Explorer

found following working 

 

| stats count as Count by attempts
| eventstats sum(Count) as Total
| eval perc=round((Count/Total)*100,2)
| fields - Total
| sort 0 - Count
| head 10

0 Karma

splunkDevendra
Explorer

How to minus one attempt from final table as it counts 1 extra attempt in every event

0 Karma

ITWhisperer
Legend
| eval attempts=mvcount(status)-1
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!