Splunk Search

Search query result from two log statements.

mahenderj
New Member

Hi,

I wanted to search result as count from two log statements.
one log statement has value "...Out of stock ..."
and another log statement has "DF Suppressed"
I wanted to get count of these two for transaction for past 10 days. Each log statement prints with a transactionId.

This is the one I have for only one item
index=idp_* "DF Suppressed" | dedup x_TraceId | stats count as DF_Supress_count | where DF_Supress_count>0

But I want to include "Out of stock" to the query

0 Karma

wmyersas
Builder

Maybe something like this:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

Add additional filtering later - for example:

| where dfsCount>0 AND oosCount>0

...or whatever else you might like.

This will create two new fields - dfsuppressed and outofstock - which will either have the text you're looking for in them, or be null.

0 Karma

mahenderj
New Member

Thanks for your answer.
Your search criteria ran without any errors but I see only Out of Stock(oosCount ) counts and 0 count for dfsCount.

0 Karma

wmyersas
Builder

Add a |fillnull between the second | rex line and the | stats thusly:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| fillnull
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

You may have events where one or the other of the rex lines isn't pulling an actual value, so it's getting null. Adding a | fillnull will put the value of 0 in any otherwise-null fields.

Also, make sure that the exact text is correct on the rex lines (eg "Out of stock" vs "Out Of Stock")

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...