I want to find out the count of events that have field with "ctx.props.Name" has either string syniverse/openmarket , with timeout string
field=
ctx.props.Name=
and values of the field = test.openmarket.seesion.4, test.syniverse.session2 , test.openmarket.seesion.1, test.syniverse.session3
i need to ignore the pre and post strings before syniverse and openmarket
I have tried eval, split and other commands , but it wasn't working.
Final output should look like below:
aggregator count
openmarket 3
syniverse 5
Sample data:
{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.2","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.
{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.4","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession
{"v":"1.0.1","time":"2016-04-29T04:24:15.692Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Openmarket.Session.4","SystemId":"1234567890OM","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)","at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)","at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)","at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre
Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?
Try one of this
index=foo sourcetype=bar ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | eval aggregator=if(match('ctx.props.Name',"openmarket"),"openmarket","syniverse") |stats count by aggregator
OR
index=foo sourcetype=bar ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | rex field=ctx.props.Name "\.(?<aggregator>(openmarket|syniverse))\." |stats count by aggregator
Hey try adding this. It should extract the "aggregator" name from the original field, and then you do a simple stats count on the new field.
| rex field=myfield ".+\.(?<newfield>.+)\." | stats count by newfield
Hi,
I don't think your JSON field is properly formatted so I did have to append "} at the end.
In any case, see if this helps:
| stats count
| fields - count
| eval myJSONfield = "
{\"v\":\"1.0.1\",\"time\":\"2016-04-29T04:24:15.692Z\",\"level\":\"ERROR\",\"thread\":\"pool-24-thread-1\",\"loggerName\":\"brickhouse.sms.gateway.smpp.SmppGateway\",\"ctx\":{\"msg\":\"Unable to bind SmppGateway\",\"props\":{\"Name\":\"Test.Openmarket.Session.4\",\"SystemId\":\"1234567890OM\",\"Port\":\"2776\",\"Host\":\"10.27.\",\"Type\":\"TRANSCEIVER\"},\"err\":{\"detail\":\"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]\",\"strackTraceElements\":[\"at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)\",\"at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)\",\"at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre\"}
"
| spath input=myJSONfield
| rex field=ctx.props.Name "(?i)(?<name>\w+)\.Session\.(?<timeout>\d+)$"
| table name, timeout
The above will give you one entry per event as follows:
name timeout
Openmarket 4
Then simply do:
stats sum(timeout) as total_timeout by name
Hope that helps.