Splunk Search

Subsearch Help

alan20854
Path Finder

Hi,

I'm trying to create a search query that displays all the events with Incorrect result: but excludes the cases where the same ID contains an event with Sending result.

The query below shows the list of all the problem cases:

host=* source=*  "Incorrect result:" | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"  | stats count by ID

How would I write a search query to do this?

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0

View solution in original post

woodcock
Esteemed Legend

Like this:

ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0

View solution in original post

sundareshr
Legend

Try this

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | chart count over ID by status | where Sending=0 | fields - Sending
0 Karma

alan20854
Path Finder

Hi sundareshr, I am not getting any events from that query

0 Karma

sundareshr
Legend

WHat do you get when you run this command?

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | table _time ID status

I also noticed, the first rex command was missing the field name. See the edited one

0 Karma