- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
I have the following query which gives me a grouped list of the java stacktraces with a total count:
tag::eventtype="host5" LogLevel="ERROR" | stats sparkline(count) as sparkline, count by CallstackEntry | sort count desc
How can I add an additional column with a count of the errors during the last hour?
Thank you very much!
Domi
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this:
tag::eventtype="host5" LogLevel="ERROR" | eval 1h_ago = if(_time >= relative_time(now(), "-h"), 1, 0)
| stats sparkline(count) as sparkline count sum(1h_ago) as count_last_hour by CallstackEntry
| sort count desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do this:
tag::eventtype="host5" LogLevel="ERROR" | eval 1h_ago = if(_time >= relative_time(now(), "-h"), 1, 0)
| stats sparkline(count) as sparkline count sum(1h_ago) as count_last_hour by CallstackEntry
| sort count desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much for this elegant solution Martin!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
very nice solution.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, but I want the number of occurences of this errormessage during the last hour..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the columns that you want to add are unique for that error/CallstackEntry, then you can add them by adding first(fieldName) into your stats. e.g.
ag::eventtype="host5" LogLevel="ERROR" | stats sparkline(count) as sparkline, count, first(errorMessage) as errorMessage, first(severity) as severity by CallstackEntry | sort count desc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi somesoni2
The log file contains java logs with errors (stack traces).
The query gives a list of these errors (grouped together) and the corresponding count of each error over the whole time.
What I want is an additional column with just the count over the last day for each error.
Regards, Domi
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What other columns you want to add? Can you provide sample logs along with the expected output?