How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

[murthychitturi]

I want to find out the count of events that have field with "ctx.props.Name" has either string syniverse/openmarket , with timeout string

field=
ctx.props.Name= 
 and values of the field  = test.openmarket.seesion.4,  test.syniverse.session2 , test.openmarket.seesion.1,  test.syniverse.session3 

i need to ignore the pre and post strings before syniverse and openmarket

I have tried eval, split and other commands , but it wasn't working.

Final output should look like below:

aggregator count

openmarket 3

syniverse 5

Sample data:

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.2","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.4","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession

{"v":"1.0.1","time":"2016-04-29T04:24:15.692Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Openmarket.Session.4","SystemId":"1234567890OM","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)","at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)","at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)","at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre

[javiergn]

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?

[somesoni2]

Try one of this

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | eval aggregator=if(match('ctx.props.Name',"openmarket"),"openmarket","syniverse") |stats count by aggregator

OR

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | rex field=ctx.props.Name "\.(?<aggregator>(openmarket|syniverse))\." |stats count by aggregator

[peter7431]

Hey try adding this. It should extract the "aggregator" name from the original field, and then you do a simple stats count on the new field.

| rex field=myfield ".+\.(?<newfield>.+)\." | stats count by newfield

[javiergn]

Hi,

I don't think your JSON field is properly formatted so I did have to append "} at the end.
In any case, see if this helps:

| stats count
| fields - count
| eval myJSONfield = "
{\"v\":\"1.0.1\",\"time\":\"2016-04-29T04:24:15.692Z\",\"level\":\"ERROR\",\"thread\":\"pool-24-thread-1\",\"loggerName\":\"brickhouse.sms.gateway.smpp.SmppGateway\",\"ctx\":{\"msg\":\"Unable to bind SmppGateway\",\"props\":{\"Name\":\"Test.Openmarket.Session.4\",\"SystemId\":\"1234567890OM\",\"Port\":\"2776\",\"Host\":\"10.27.\",\"Type\":\"TRANSCEIVER\"},\"err\":{\"detail\":\"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]\",\"strackTraceElements\":[\"at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)\",\"at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)\",\"at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre\"}
"
| spath input=myJSONfield
| rex field=ctx.props.Name "(?i)(?<name>\w+)\.Session\.(?<timeout>\d+)$"
| table name, timeout

The above will give you one entry per event as follows:

name    timeout
Openmarket  4 

Then simply do:

stats sum(timeout) as total_timeout by name

Hope that helps.