Splunk Search
Highlighted

Search query result from two log statements.

New Member

Hi,

I wanted to search result as count from two log statements.
one log statement has value "...Out of stock ..."
and another log statement has "DF Suppressed"
I wanted to get count of these two for transaction for past 10 days. Each log statement prints with a transactionId.

This is the one I have for only one item
index=idp* "DF Suppressed" | dedup xTraceId | stats count as DFSupresscount | where DFSupresscount>0

But I want to include "Out of stock" to the query

0 Karma
Highlighted

Re: Search query result from two log statements.

Builder

Maybe something like this:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

Add additional filtering later - for example:

| where dfsCount>0 AND oosCount>0

...or whatever else you might like.

This will create two new fields - dfsuppressed and outofstock - which will either have the text you're looking for in them, or be null.

0 Karma
Highlighted

Re: Search query result from two log statements.

New Member

Thanks for your answer.
Your search criteria ran without any errors but I see only Out of Stock(oosCount ) counts and 0 count for dfsCount.

0 Karma
Highlighted

Re: Search query result from two log statements.

Builder

Add a |fillnull between the second | rex line and the | stats thusly:

index=idp_* ("DF Suppressed" OR "Out of stock") transactionId=*
| rex field=_raw ".+(?<dfsuppressed>DF Suppressed)"
| rex field=_raw ".+(?<outofstock>Out of stock)"
| fillnull
| stats count(outofstock) as oosCount count(dfsuppressed) as dfsCount by transactionId

You may have events where one or the other of the rex lines isn't pulling an actual value, so it's getting null. Adding a | fillnull will put the value of 0 in any otherwise-null fields.

Also, make sure that the exact text is correct on the rex lines (eg "Out of stock" vs "Out Of Stock")

0 Karma