Splunk Search

Showing log counts by error type

cinimins
Explorer

Hello,

I would like to make a stacked column chart with number of errors by hour and error type (warning, error, etc)

The log lines look like this:

 

[2023-07-19T03:55:16,043][ERROR][o.o.s.i.DetectorIndexManagementService] [opensearch-cluster-master-2] info deleteOldIndices

 

 

I was filtering out INFO messages, parsing the error type using a regex (which both work so far), but I cannot group it by error type.

 

 

index=* "pod"="*opensearch*"
| search NOT "[INFO ]"
| rex field=_raw "^\[([0-9\-T:,]*)\]\[(?<type>[A-Za-z ]*)\]"
| timechart span=1h count
```| stats avg(count) as count by Hour type```
| chart avg(count) AS count BY Hour type

 

 

I only get one value per hour, labeled as "count". Any suggestion how I could split it by Hour *and* type?

Thank you!

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cinimins,

after the timechart command you have only two fields: _time and count, so type isn't still available.

then you could use a simplerregex:

| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"

then, you don't need to use the search command after the main search, in this way you have a slower search.

that you can test at https://regex101.com/r/VN8vWd/1

Anyway, please see this:

index=* "pod"="*opensearch*" NOT "[INFO]"
| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"
| eval Hour=strftime(_time,"%H")
| chart count OVER Hour BY type

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cinimins,

after the timechart command you have only two fields: _time and count, so type isn't still available.

then you could use a simplerregex:

| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"

then, you don't need to use the search command after the main search, in this way you have a slower search.

that you can test at https://regex101.com/r/VN8vWd/1

Anyway, please see this:

index=* "pod"="*opensearch*" NOT "[INFO]"
| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"
| eval Hour=strftime(_time,"%H")
| chart count OVER Hour BY type

Ciao.

Giuseppe

 

cinimins
Explorer

Thanks for your help, it works! I haven't seen the OVER keyword before 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...