Example: errormessages total
user a not found. 7
user b not found. 5
user c not found. 10
Result should be :
user not found. 22
Hi @REACHGPRAVEEN,
Please try below;
| eval errormsg=if(errormessages LIKE "user % not found","user not found","")
| stats sum(total) as total by errormsg
Hi @REACHGPRAVEEN,
I used your sample data. Using a similar method that I sampled, you should be able to convert to a unique value to make a sum. If there is another field in your logs like error_id you can use that field for grouping.
It is not easy without knowing your data.
Thanks for the response. but i do have lot of messages with that criteria. in that case do we have to write for each message like above
i have messages as below:
1) Exception message: {"errorMessage":"Unable to find element with pathh '//input[@type=text][@name='User']'",.........
2) error, please visit: www.testsel.com . xxxxxx
3) error=the user xxxx already exists (more number of users are there)
4) error= we were unable to process you request {xx=cvb,xx=asdf,}
5) Exception message: no such user: Unable to locate user: {xx=cvb,xx=asdf,}}
the result should be:
errormessage total
Unable to find element with path. total count of similar messages beside
please visit: www.testsel.com total count of similar messages beside
the user already exists total count of similar messages beside
we were unable to process you request. total count of similar messages beside
Unable to locate user total count of similar messages beside
PLease suggest a solution
Hi @REACHGPRAVEEN,
Please try below;
| eval errormsg=if(errormessages LIKE "user % not found","user not found","")
| stats sum(total) as total by errormsg