Splunk Search

How to search the count of field value occurrences, not event count, of multivalue fields in multiline events?

masonmorales
Influencer

I have multiline events that contain anywhere from 1 to 30 status codes per event. For example:

status = success
status = success
status = failed
status = success

By default, I get a single field called "status" that contains a count of how many times "success" occurred and how many times "failed" occurred.

I would like to have two separate numerical fields, one called success_count and the other called failed_count that contain a count of how many times each value of the "status" field occurred per event (i.e. success_count=3, failed_count=1 in this example).

I have tried:

| stats count(eval(status="success")) as success_count, count(eval(status="failed")) as failed_count

However, the resulting counts appear to be the number of events that contain success_count and the number of events that contain failed_count, rather than a total count of all the field value occurrences for status=failed and status=success within each event.

Any help would be greatly appreciated!

1 Solution

ramdaspr
Contributor

Assuming you have a mutivalue field called status the below (untested) code might work.

 .. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count

View solution in original post

ppablo
Retired

Hi @masonmorales

Just following up with this question, but did @ramdaspr's answer below help solve your question? If yes, please resolve this post by clicking "Accept" directly below the answer. If you found another solution that did work, please share. Thanks!

0 Karma

ramdaspr
Contributor

Assuming you have a mutivalue field called status the below (untested) code might work.

 .. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...