Splunk Search

Stats count query across possible fields from multiple sources?

spark2310
Explorer

I am trying to create an alert but some issues with logging that is not standard, so each sourcetype has it's own certain fieldname for error levels (e.g. type), and another certain fieldname for their error message (e.g. msg, or Massage)... in other words, I know the possible field values common across sourcetypes and eventually wanting to timechart or stat to cover all possible fields regardless of data source

This still does not work and if a certain field does not exist, all results will be null. any ideas or a different way to do it?

My query: index=t sourcetype=* (type=error OR T=error OR Level=Critical) (msg=* OR MSG=* OR Message=* OR message=* OR reason=*) |eval MM=msg."".MSGmsg."".Message."".message."".reason|timechart count by MM

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Concatenation will not solve that problem. You want the coalesce function. It chooses the first non-null field from its arguments as its result, which is exactly what you need when some fields are present in some events, but not others.

index=t sourcetype= (type=error OR T=error OR Level=Critical) (msg= OR MSG= OR Message= OR message= OR reason=) 
|eval MM=coalesce(msg,  MSGmsg, Message, message, reason) 
|timechart count by MM
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Concatenation will not solve that problem. You want the coalesce function. It chooses the first non-null field from its arguments as its result, which is exactly what you need when some fields are present in some events, but not others.

index=t sourcetype= (type=error OR T=error OR Level=Critical) (msg= OR MSG= OR Message= OR message= OR reason=) 
|eval MM=coalesce(msg,  MSGmsg, Message, message, reason) 
|timechart count by MM
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!