Hello,
I have this search results:
Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}
I'm trying to get the number of each each _errorCode for each user flow.
I started with
index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | stats count as ErrorCount by user_flow
I was able to get the number of error occurrences under each user flow. I wanted to expand this query to be more granular and include the error code so I would have:
UserFlow | ErrorCode | Error Count |
AAAA | X | 5 |
AAAA | Y | 7 |
BBBB | F | 1 |
BBBB | G | 2 |
This is the query I came up with but the statistics tab are no longer showing anything
index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | rex field=_raw "_errorCode:\\\":(?<error_code>\d+)" |stats count as ErrorCount by user_flow, error_code
I see the events tab are still populated with search results but it looks like my addition to the query is not quite correct.
Hi @frnSpLrnr11,
please try this, where the first row is only for the sample:
| makeresults | eval _raw="Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}"
| rex field=_raw "user flow: (?<user_flow>\w+)"
| rex field=_raw "_errorCode\\\":(?<error_code>[^,]+)"
| stats values(error_code) AS error_code count BY user_flow
Ciao.
Giuseppe
Hi @frnSpLrnr11,
please try this, where the first row is only for the sample:
| makeresults | eval _raw="Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}"
| rex field=_raw "user flow: (?<user_flow>\w+)"
| rex field=_raw "_errorCode\\\":(?<error_code>[^,]+)"
| stats values(error_code) AS error_code count BY user_flow
Ciao.
Giuseppe
Hi @frnSpLrnr11,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉