Hello everybody!
Trying to search for a series of strings - then count and display by host. I got this far:
index=index host=*server* "failover" OR "Whatever" OR "screwup"
| rex "(?<error>failover)"
| rex "(?<error>Whatever)"
| rex "(?<error>screwup)"
| stats count by host,error
| xyseries error,host,count
So I get a chart like so:
error server1 server2 server3
screwup 10 11 18
Which is what I want - but I only get the last result set (for screwup). I know all 3 have results. What am I doing wrong in creating my new field called error with 3 possible values?
Skiller
Change your rex like this:
| rex "(?(?:failover|Whatever|screwup))"
This should check all conditions in one. Else every rex line has the potential to overwrite the result from the line(s) before it. 😉
EDIT: Can there be more than one error in the same event?
In that case, do | rex max_match=0 "(?(?:failover|Whatever|screwup))"
Change your rex like this:
| rex "(?(?:failover|Whatever|screwup))"
This should check all conditions in one. Else every rex line has the potential to overwrite the result from the line(s) before it. 😉
EDIT: Can there be more than one error in the same event?
In that case, do | rex max_match=0 "(?(?:failover|Whatever|screwup))"
Please share some sample events.