Hi,
I'm trying to create a search query that displays all the events with Incorrect result:
but excludes the cases where the same ID contains an event with Sending result
.
The query below shows the list of all the problem cases:
host=* source=* "Incorrect result:" | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D" | stats count by ID
How would I write a search query to do this?
Like this:
ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0
Like this:
ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0
Try this
host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | chart count over ID by status | where Sending=0 | fields - Sending
Hi sundareshr, I am not getting any events from that query
WHat do you get when you run this command?
host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | table _time ID status
I also noticed, the first rex command was missing the field name. See the edited one