How to count valid and invalid requests at the same time?

[vamshiverma]

Hello,

I want to display the total count of events and failed events count. In my case, it is determined by the field DETAIL

The following query does return the count by sourcetype "foo.bar.* and having error or exception.

index=myindex sourcetype=foo.bar.* DETAIL ="*error*" OR DETAIL ="*exception*"| stats count(UNIQUE_ID) as Fail by sourcetype

Sourcetype	Fail
foo.bar.cat	3
foo.bar.dog	2

I tried to query using the following to determine total events for individual sourcetype and the fails for the same. But, the fails are always returned as zero.

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | search index=myindex sourcetype=foo.bar*  DETAIL ="*error*" OR DETAIL ="*exception*"|stats count(UNIQUE_ID) as Fail by src| fields sourcetype Total Fail

Sourcetype	Total	Fail
foo.bar.cat	153	0
foo.bar.dog	128	0

I tried using subsearch for the below query, but this one doesn't even work at all.

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | stats count(eval( DETAIL ="*error*" OR DETAIL ="*exception*")) as fail values(Total) as Total by src | fields src Total fail

I appreciate your time and support!

Thanks!!

[askkawalkar]

index=myindex sourcetype=foo.bar*
| eval status=case(like(DETAIL,"%error%"),"Fail",like(DETAIL,"%exception%"),"Fail",true(), "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail

Hi @vamshiverma , can you please try using  above. 

Regards,

Ankush

[vamshiverma]

Thank you! @askkawalkar. It helped a lot. Awesome!😊

[askkawalkar]

@vamshiverma , Kindly accept answer for question, which is most helpful, So that others can use it if required. 

Regards, 

Ankush

[Nisha18789]

@vamshiverma , can you try below and see if you getting the desired results

index=myindex sourcetype=foo.bar.*
|eval type=if(DETAIL="*error*" OR DETAIL="*exception*","Fail","other")
|stats count(UNIQUE_ID) as Total sum(eval(status="Fail")) as Fail by sourcetype

[vamshiverma]

Thank you !! @Nisha18789  , it's working. 😀

[richgalloway]

You may not need a subsearch.  Try this query.

index=myindex sourcetype=foo.bar*
| eval status=if(searchmatch(DETAIL ="*error*" OR DETAIL ="*exception*"), "Fail", "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail

[richgalloway]

Sorry about that.  Try this alternative.

index=myindex sourcetype=foo.bar*
| eval status=case(searchmatch(DETAIL ="*error*"), "Fail", searchmatch(DETAIL ="*exception*"), "Fail", 1==1, "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail

[vamshiverma]

@richgalloway   slick and smooth way to solve, thanks a lot!! 😊

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[vamshiverma]

@richgalloway Thank you for the reply, I appreciate it.

I tried to run the same query but it is throwing "Error in 'eval' command: The arguments to the 'searchmatch' function are invalid."