Splunk Search

Looking for a result each day in the week

rjoller
Explorer

Hello

In my base search I'm looking for stores with the minimum count of 1 for 4 differend kind of errors. I count the errors, put them in a xyseries table and filter them out - which works great.

Now i would like to know which stores on which day hit all the criterias.

-----------------------------------
                Code
-----------------------------------

index=main host=*
(thrown NotFoundException:Not found) OR
(X-30056) OR
(Interceptor for tx_pool ITransactionPool has thrown exception, unwinding now) OR
(SocketTimeoutException Read Timeout)
| rex field=_raw "An accepted error occurred:.(?<exception>\w+-\d+):."
| rex field=_raw "SocketTimeoutException: R(?<exception>\w+.\w+)"
| rex field=_raw "serverDataState:.(?<exception>\w+.\w+)"
| rex field=_raw "Caused by: java.io.InterruptedIOException:.(?<exception>.*)"
| rex field=_raw "thrown NotFoundException:(?<exception>\w+.\w+)"
| eval ccc = cooperative+cost_center
| stats count by ccc exception
| xyseries ccc exception count
| search X-30056 > 0 AND "Read Timeout" > 0 AND "Not found" > 0 AND "Output operation aborted" > 0

-----------------------------------
               Result
-----------------------------------
ccc X-30056 Not found Output operation aborted Read Timeout Read Timeout Read timed
0011111 339 6 12 193 364
0022222 620 4 1 640 992 1
0033333 588 4 7 2549 4956 1

What I would like to achieve is the following:

Date                 ccc
08/17/2021 0011111
08/18/2021 0022222
08/20/2021 0033333

I'm thankful for any help!

Labels (2)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval ccc = cooperative+cost_center
| bin _time span=1d
| eval dataccc=strftime(_time,"%m/%d/%Y")."!".ccc
| stats count by dateccc exception
| xyseries dateccc exception count
| where 'X-30056' > 0 AND 'Read Timeout' > 0 AND 'Not found' > 0 AND 'Output operation aborted' > 0
| eval date=mvindex(split(dateccc,"!"),0)
| eval ccc=mvindex(split(dateccc,"!"),1)
| table date ccc

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| eval ccc = cooperative+cost_center
| bin _time span=1d
| eval dataccc=strftime(_time,"%m/%d/%Y")."!".ccc
| stats count by dateccc exception
| xyseries dateccc exception count
| where 'X-30056' > 0 AND 'Read Timeout' > 0 AND 'Not found' > 0 AND 'Output operation aborted' > 0
| eval date=mvindex(split(dateccc,"!"),0)
| eval ccc=mvindex(split(dateccc,"!"),1)
| table date ccc

rjoller
Explorer

Hi @ITWhisperer 

When I use "dateccc" in the first eval it works. Thanks for the good suggestion!

The mvindex and split-commands are new for me - i'will digg deeper into those!

 

Thanks a lot!

0 Karma

sguez
Observer

did you try instead of stats to use:

 

| timechart count by ccc exception span=1d 

0 Karma

rjoller
Explorer

yes I think timechart only allows you to count one arugemnt

 

replace stats with your command gives me back the following error:

"Error in 'timechart' command: The argument 'exception' is invalid."

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...