Splunk Search

How to get the stats of multiple search string

ibob0304
Communicator

I am trying to get the stats for the search keywords. My query will list the errors by time but it wont tell me how many errors came for each search string.

index=main source=*event* | search "NETWORK error" OR "OPS error" OR "NETSTAT ERROR" | bucket span=5m _time | stats count by _time

woodcock
Esteemed Legend

Like this:

index=main source=*event* AND ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| timechart span=5m count AS total count(eval(searchmatch("NETWORK error")) AS network_error count(eval(searchmatch("OPS error")) AS ops_error count(eval(searchmatch("NETSTAT error")) AS netstat_error

aberkow
Builder
index=main source=*event* ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| eval searchString = case(like(_raw, "%NETWORK error%"), "Network Error", like(_raw, "%OPS error%"), "Ops Error",  like(_raw, "%NETSTAT error%"), "Netstat Error", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString

I just assumed you were using the _raw field for your search and moved it up into the main search, but the general idea is you want to use a field with a string match - either like, equals, match, etc (check out some options here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#like.28TEXT....) to create a field you can stats count by. You could do this in a bunch of other ways too, but I think this is the cleanest one.

Hope this helps!

Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...