Splunk Search

counting occurences of a string in the log message

tomasv
Explorer

Our logs contain some multi-line messages (e.g. a list of tasks running) that look like this

ID, state, comment
1544, sleep, 'not doing anything'
2547, working, 'executing task ...'
3514, sleep, 'not doing anything'
7877, working, 'executing task ...'

I need to count how many tasks were running / sleeping - I thought I could simply count 'sleep' occurrences, but I can't find a suitable command / function. How to do that?

0 Karma

Drainy
Champion

Ok, so I dumped your data into a log file just to test.
First of all I assume you haven't done any extraction so you want to use multikv to extract the values against the header fields. Next you can just do a search to filter down to those values and then count them, like so;

sourcetype=mvdata | multikv | search state=" sleep" | stats count

Note that sleep has been extracted with a space before it, you could fix this with rex but I'll leave that for you to have a play with and come back if you get stuck 🙂

Is that what you were after?
You could always do a | stats count by state to count the different states if you wanted.

EDIT:

Ok, so there are a couple of ways to do that, here is one that I've quickly thrown together that should work;

| multikv | stats count by state,_time | transaction _time

Drainy
Champion

Ah, I'll pop an update above

0 Karma

tomasv
Explorer

Thanks, although I've just noticed that my question was ambiguous.
My goal was to get something like '5 rows with Sleep state, 1 in Active state' for each multi-line message.

This works a bit differently (if I unterstand it correctly), i.e. it splits the multi-line log into independent log messages and then I can search those to get "global counts".

In the end it gives me most of the info I needed (how many 'Sleep' or 'Active' messages were there through the day) but if possible I'd like to know e.g. the number of 'Sleep-only' messages etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...