How to search for a series of strings then count and display by host?

[skiller1234]

Hello everybody!

Trying to search for a series of strings - then count and display by host. I got this far:

index=index host=*server* "failover" OR "Whatever" OR "screwup"
| rex "(?<error>failover)"
| rex "(?<error>Whatever)"
| rex "(?<error>screwup)"
| stats count by host,error
| xyseries error,host,count

So I get a chart like so:

error                     server1                       server2                  server3

screwup                10                                      11                            18

Which is what I want - but I only get the last result set (for screwup). I know all 3 have results. What am I doing wrong in creating my new field called error with 3 possible values?

Skiller

[xpac · Accepted solution]

Change your rex like this:

| rex "(?(?:failover|Whatever|screwup))"

This should check all conditions in one. Else every rex line has the potential to overwrite the result from the line(s) before it. 😉

EDIT: Can there be more than one error in the same event?

In that case, do | rex max_match=0 "(?(?:failover|Whatever|screwup))"

[richgalloway]

Please share some sample events.