Hi All,
I am facing some problem with my below search:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | stats count(eval(eventItemID="*BT*")) as "BT_VOD_buffer_underrun_count" count(eval(eventItemID!="")) as "Total_VOD_buffer_underrun_count"
Here the "BT_VOD_buffer_underrun_count" is always returning zero. The problem lies with count(eval(eventItemID="*BT*"))
. I have also tried searchmatch, but every time it returns an error.
I want to count all events with "eventItemID" field containing "BT" in its value.
Please help.
Please help.
You should be able to use like()
in the eval expression to match with wildcards:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | stats count(eval(like(eventItemID,"%BT%"))) as "BT_VOD_buffer_underrun_count" count(eval(!like(eventItemID, "%BT%"))) as "Total_VOD_buffer_underrun_count"
But it would be less verbose to eval a field first, and do the stats on that, something like:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | eval eventItemIdType=if(like(eventItemID,"%BT%"), "BT_VOD_buffer_underrun_count", "Total_VOD_buffer_underrun_count") | stats count by eventItemIdType
You should be able to use like()
in the eval expression to match with wildcards:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | stats count(eval(like(eventItemID,"%BT%"))) as "BT_VOD_buffer_underrun_count" count(eval(!like(eventItemID, "%BT%"))) as "Total_VOD_buffer_underrun_count"
But it would be less verbose to eval a field first, and do the stats on that, something like:
sourcetype="clientevents" event_error_code=RB_VOD_BUFFER_UNDERFLOW eventItemID="*" | eval eventItemIdType=if(like(eventItemID,"%BT%"), "BT_VOD_buffer_underrun_count", "Total_VOD_buffer_underrun_count") | stats count by eventItemIdType
Note that the second search gives a different result, so you probably want to modify it.
Thanks laserval!