Splunk Search

Multiple value for the same field in one event.How to determine statistics

prettysunshinez
Explorer

I have an event having 3 errors..
I have a regular expression written to capture the error as "ERROR".
And now i have a lookup file and I input the ERROR value and output Comments for the respective error.

I do not have issues when there is just one value for ERROR field in one event(i.e., if there is only one error in a event)
But when there are more than one error,then i get the result as below.
Kindly help..

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

Expand ERROR values before lookup command.

index= |(regular expression to catch the error from the logs as ERROR) | mvexpand ERROR | lookup abc.csv ERROR output Comments |stats count by Comments

View solution in original post

0 Karma

manjunathmeti
Champion

Expand ERROR values before lookup command.

index= |(regular expression to catch the error from the logs as ERROR) | mvexpand ERROR | lookup abc.csv ERROR output Comments |stats count by Comments
0 Karma

woodcock
Esteemed Legend

What you are describing is not possible unless you have a Lookup Definition with some extra settings in it. It is pointless to continue without you spelling out everything including at least 2 lines of your Lookup File and your search SPL and your Lookup Definition.

0 Karma

to4kawa
Ultra Champion
index=your_index 
|(regular expression to catch the error from the logs as ERROR) 
| stats count by ERROR
| lookup abc.csv ERROR output Comments 

I see, this query excludes same ERROR
How about this?

In your last comment, |stats count by Comments
This result is following:

Comments count
abc  3
bcd  1
....

This result is not your first expect result.
Which do you want?

0 Karma

prettysunshinez
Explorer

Am sorry I missed it..
I get the error also as part of output from lookup file..and i do statistics count and values based on ERROR..

0 Karma

prettysunshinez
Explorer

index= |(regular expression to catch the error from the logs as ERROR) | lookup abc.csv ERROR output Comments |stats count by Comments

abc.csv:
ERROR Comments
Error1 abc
Error2 abc
Error3 bcd
Error4 bed
Error5 abc

0 Karma

woodcock
Esteemed Legend

Why are you being so vauge? Show us ALL of your search! The rex part is probably THE MOST IMPORTANT PART and yet you stripped it!?!?

0 Karma

prettysunshinez
Explorer

Regular followed by max_match=0..
In order to capture all the occurences of ERROR

0 Karma

woodcock
Esteemed Legend

SHOW US THE FULL SEARCH SPL and a few sample events.

0 Karma

manjunathmeti
Champion

can you post your query?

0 Karma

to4kawa
Ultra Champion

"ERROR" field is multivalue?

0 Karma

prettysunshinez
Explorer

Single value only

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...