Splunk Search

Question on calculating statistics for a field with different values in one event

prettysunshinez
Explorer

I have a difficulty in calculating statistics when different (multiple) values are present for a field in the same event.
My query now extract the error field (for which i have written the regular expression) and looks for the error and calculate count.
How to overcome this..
Please help!

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You need to output one comment for each errors so expand error values before running lookup.

Index =  | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs error_description comments | search comments="$comment$" | stats count by error_description

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

index = ...
| regular expression to catch error max_match=0
| stats count BY error
| lookup lookupfile_name error OUTPUT error_description comments
| search comments="medium"
| stats sum(count) AS count BY error_description
0 Karma

woodcock
Esteemed Legend

This is what it should do; what would you prefer that it do?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You need to output one comment for each errors so expand error values before running lookup.

Index =  | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs error_description comments | search comments="$comment$" | stats count by error_description
0 Karma

prettysunshinez
Explorer

Thank You @manjunathmeti
It worked 🙂

I also have another question which is a kind of enhancement to the above query..

In the lookup under Comments column I only have 3 catergories (For say : High,Medium,Low)
And now based on the output of the above query (my initial question), if the error5 which is Low and when its count exceeds a certain limit (say 200) ,its Comment has to be changed as Medium.
I'm have no clue as to how to start with it..
Could you kindly help..

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...