count over a subtime

[sirdomi]

Hello

I have the following query which gives me a grouped list of the java stacktraces with a total count:

tag::eventtype="host5" LogLevel="ERROR" | stats sparkline(count) as sparkline, count by CallstackEntry | sort count desc

How can I add an additional column with a count of the errors during the last hour?

Thank you very much!
Domi

[martin_mueller · Accepted solution]

You can do this:

tag::eventtype="host5" LogLevel="ERROR" | eval 1h_ago = if(_time >= relative_time(now(), "-h"), 1, 0)
| stats sparkline(count) as sparkline count sum(1h_ago) as count_last_hour by CallstackEntry
| sort count desc

[sirdomi]

Thank you very much for this elegant solution Martin!

[cramasta]

very nice solution.

[sirdomi]

Thanks, but I want the number of occurences of this errormessage during the last hour..

[somesoni2]

If the columns that you want to add are unique for that error/CallstackEntry, then you can add them by adding first(fieldName) into your stats. e.g.

ag::eventtype="host5" LogLevel="ERROR" | stats sparkline(count) as sparkline, count, first(errorMessage) as errorMessage, first(severity) as severity by CallstackEntry | sort count desc

[sirdomi]

Hi somesoni2

The log file contains java logs with errors (stack traces).
The query gives a list of these errors (grouped together) and the corresponding count of each error over the whole time.
What I want is an additional column with just the count over the last day for each error.

Regards, Domi

[somesoni2]

What other columns you want to add? Can you provide sample logs along with the expected output?