Simple syntax to filter data by _raw value

[razlani]

Hi all - I'm new here (literally an hour old) so go easy.

I've read through parts of the docs and am currently using:

host=crm index=main tag=error | eval kek = regex_raw = "[email protected]" | stats count by kek

On data like:

2015-01-16 13:00:19,747 [[email protected]] ERROR jelly.fish.cake......

To try and play with data filtered by counting errors from particular usernames in the raw data like so.

I'm almost there but get an error message about using eval on boolean data (the docs of which I've read); but which I've still yet to nail the syntax for.

I've tried using rex, an if statement with eval (as suggested), tostring() (as suggested) and phrasing it differently like piping the data into the eval... but that simply pipes all of the data rather than the usernames I'm interested in - and it seems like I just can't get the syntax right.

Could you please tell me how I could filter data by the email address and count them like I'm trying?

Thanks so much!!

raz

[richgalloway · Accepted solution]

Assuming you want to filter a single email address, your example could written something like this:

host=crm index=main tag=error "[email protected]" | stats count(_time)

This pulls all events from the main index where the host field has the value "crm", are tagged as "error", and contain "[email protected]" somewhere in them. It then counts the events found.

Something more generic might be:

host=crm index=main tag=error | rex "\[(?P<addr>[^\]]+)\]" | stats count(_time) by addr

Again, we're looking at all events from the main index where the host field has the value "crm" and are tagged as "error". The rex command extracts anything between square brackets from the _raw field (by default) and puts it into a field called "addr". We then count each addr found.

[razlani]

Thank you both!

[somesoni2]

Try this

Get count by email address

host=crm index=main tag=error |  rex "\[(?<kek>.[^\]]+)\]" | stats count by kek

[razlani]

would make both answers correct if I could