Hi, I am running below query and expecting count of failureCount, warningCount in table as total count (1 row only), however it's not returning anything, Where I am going wrong?
index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where
(verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount
Try changing
| eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount
to
| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount
Wohoo, it works, thanks for the help
Try changing
| eval failureCount count by error="failure" | eval warningCount count by error="warning" | table failureCount, warningCount
to
| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount
I am not able to print index in table while running below query
index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount | table index failureCount warningCount
However with below query index is printed but I want index , warningCount and failureCount as well
index="deng03-cis-dev-audit" | spath PATH=data.labels.verbose_message output=verbose_message | search "data.labels.activity_type_name"="ViolationOpenEventv1" | where (verbose_message like "%Oldest unacked message age%evt%" or verbose_message like "%Oldest unacked message age%rec%") | eval error=case(like(verbose_message,"%above the threshold of 1800.000%"), "warning", like(verbose_message,"%above the threshold of 300.000%"), "failure") | eval service = index | table index
| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount
only has two fields on output, failureCount and warningCount i.e. the two fields mentioned in the command.
If you want index to be available after the stats command, it has to be included
| stats count(eval(error=="failure")) as failureCount count(eval(error=="warning")) as warningCount values(index) as index