Splunk Search

How to get the stats of multiple search string

ibob0304
Communicator

I am trying to get the stats for the search keywords. My query will list the errors by time but it wont tell me how many errors came for each search string.

index=main source=*event* | search "NETWORK error" OR "OPS error" OR "NETSTAT ERROR" | bucket span=5m _time | stats count by _time

woodcock
Esteemed Legend

Like this:

index=main source=*event* AND ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| timechart span=5m count AS total count(eval(searchmatch("NETWORK error")) AS network_error count(eval(searchmatch("OPS error")) AS ops_error count(eval(searchmatch("NETSTAT error")) AS netstat_error

aberkow
Builder
index=main source=*event* ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| eval searchString = case(like(_raw, "%NETWORK error%"), "Network Error", like(_raw, "%OPS error%"), "Ops Error",  like(_raw, "%NETSTAT error%"), "Netstat Error", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString

I just assumed you were using the _raw field for your search and moved it up into the main search, but the general idea is you want to use a field with a string match - either like, equals, match, etc (check out some options here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#like.28TEXT....) to create a field you can stats count by. You could do this in a bunch of other ways too, but I think this is the cleanest one.

Hope this helps!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...