Splunk Search

Showing log counts by error type

cinimins
Explorer

Hello,

I would like to make a stacked column chart with number of errors by hour and error type (warning, error, etc)

The log lines look like this:

 

[2023-07-19T03:55:16,043][ERROR][o.o.s.i.DetectorIndexManagementService] [opensearch-cluster-master-2] info deleteOldIndices

 

 

I was filtering out INFO messages, parsing the error type using a regex (which both work so far), but I cannot group it by error type.

 

 

index=* "pod"="*opensearch*"
| search NOT "[INFO ]"
| rex field=_raw "^\[([0-9\-T:,]*)\]\[(?<type>[A-Za-z ]*)\]"
| timechart span=1h count
```| stats avg(count) as count by Hour type```
| chart avg(count) AS count BY Hour type

 

 

I only get one value per hour, labeled as "count". Any suggestion how I could split it by Hour *and* type?

Thank you!

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cinimins,

after the timechart command you have only two fields: _time and count, so type isn't still available.

then you could use a simplerregex:

| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"

then, you don't need to use the search command after the main search, in this way you have a slower search.

that you can test at https://regex101.com/r/VN8vWd/1

Anyway, please see this:

index=* "pod"="*opensearch*" NOT "[INFO]"
| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"
| eval Hour=strftime(_time,"%H")
| chart count OVER Hour BY type

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cinimins,

after the timechart command you have only two fields: _time and count, so type isn't still available.

then you could use a simplerregex:

| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"

then, you don't need to use the search command after the main search, in this way you have a slower search.

that you can test at https://regex101.com/r/VN8vWd/1

Anyway, please see this:

index=* "pod"="*opensearch*" NOT "[INFO]"
| rex "^\[[^\]]*\]\[(?<type>[^\]]+)"
| eval Hour=strftime(_time,"%H")
| chart count OVER Hour BY type

Ciao.

Giuseppe

 

cinimins
Explorer

Thanks for your help, it works! I haven't seen the OVER keyword before 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...