Subsearch Help

[alan20854]

Hi,

I'm trying to create a search query that displays all the events with Incorrect result: but excludes the cases where the same ID contains an event with Sending result.

The query below shows the list of all the problem cases:

host=* source=*  "Incorrect result:" | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"  | stats count by ID

How would I write a search query to do this?

[woodcock · Accepted solution]

Like this:

ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0

[sundareshr]

Try this

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | chart count over ID by status | where Sending=0 | fields - Sending

[alan20854]

Hi sundareshr, I am not getting any events from that query

[sundareshr]

WHat do you get when you run this command?

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | table _time ID status

I also noticed, the first rex command was missing the field name. See the edited one