Splunk Search

How to get overall stats if in a single log a particular event is missing?

New Member

Hello There,

I am trying to get an overall stats for all the logs with a particular sourcetype, however in some sourcetye a particular event is missing from which i am applying a filter, for an example there are 10 (2 where test from my side, 5 success and 3 fail), if i have to filter out test there is only 1 way i.e. by locator now problem is for 'failure' locator does not get fired, hence if I apply a filter to exclude test, I am not getting stats of Failure as well, can anyone please help me how can i get overall stats by only excluding test and getting insights on both Success and fail?

below is the script which i am using.

sourcetype=book_resptime (locator!="TST*" OR locator!="TEST*") |
| stats count(book_success) AS Book, count(eval(book_success=0)) AS BookFail by connector

Thanks

0 Karma

SplunkTrust
SplunkTrust

Thank you!

0 Karma

SplunkTrust
SplunkTrust

Please don't tag questions with an app if they're not related to that app.

0 Karma

New Member

Removed the app tag

0 Karma

Super Champion

can you try like:

sourcetype=book_resptime (locator!="TST*" OR locator!="TEST*") |fillnull locator value=0| stats count(book_success) AS Book, count(eval(book_success=0)) AS BookFail by connector
0 Karma

New Member

Hey Thanks for that, for Bookfail locator will not get fired, so it's not working.

0 Karma

Super Champion

so by using fillnull you can fill null values...does this solves your issue?

0 Karma

New Member

no, it's not working.

0 Karma

Super Champion

if there are only 3 values then firstly you can try (locator="success" OR locator="fail")
then can you provide sample output of events

0 Karma

SplunkTrust
SplunkTrust

Is this related to the Regex IDS app?

0 Karma

New Member

Not exactly, but if regex IDS can help to get that desired answer will install that.

0 Karma