Splunk Search

Question on calculating statistics for a field with different values in one event

prettysunshinez
Explorer

I have a difficulty in calculating statistics when different (multiple) values are present for a field in the same event.
My query now extract the error field (for which i have written the regular expression) and looks for the error and calculate count.
How to overcome this..
Please help!

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

You need to output one comment for each errors so expand error values before running lookup.

Index =  | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs error_description comments | search comments="$comment$" | stats count by error_description

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

index = ...
| regular expression to catch error max_match=0
| stats count BY error
| lookup lookupfile_name error OUTPUT error_description comments
| search comments="medium"
| stats sum(count) AS count BY error_description
0 Karma

woodcock
Esteemed Legend

This is what it should do; what would you prefer that it do?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

You need to output one comment for each errors so expand error values before running lookup.

Index =  | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs error_description comments | search comments="$comment$" | stats count by error_description
0 Karma

prettysunshinez
Explorer

Thank You @manjunathmeti
It worked 🙂

I also have another question which is a kind of enhancement to the above query..

In the lookup under Comments column I only have 3 catergories (For say : High,Medium,Low)
And now based on the output of the above query (my initial question), if the error5 which is Low and when its count exceeds a certain limit (say 200) ,its Comment has to be changed as Medium.
I'm have no clue as to how to start with it..
Could you kindly help..

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...