Splunk Search

how to group similar messages into one message and get count of them

REACHGPRAVEEN
Explorer

Example:  errormessages    total

                    user a not found.     7

                    user b not found.      5

                    user c not found.      10

Result should be : 

                    user not found.      22

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @REACHGPRAVEEN,

Please try below;

| eval errormsg=if(errormessages LIKE "user % not found","user not found","")
| stats sum(total) as total by errormsg
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

Hi @REACHGPRAVEEN,

I used your sample data. Using a similar method that I sampled, you should be able to convert to a unique value to make a sum. If there is another field in your logs like error_id you can use that field for grouping.

It is not easy without knowing your data. 

If this reply helps you an upvote is appreciated.
0 Karma

REACHGPRAVEEN
Explorer

Thanks for the response. but i do have lot of messages with that criteria. in that case do we have to write for  each message like above

0 Karma

REACHGPRAVEEN
Explorer

i have messages as below:

1) Exception message: {"errorMessage":"Unable to find element with pathh '//input[@type=text][@name='User']'",.........

2) error, please visit: www.testsel.com .  xxxxxx

3) error=the user xxxx already exists (more number of users are there)

4) error= we were unable to process you request {xx=cvb,xx=asdf,}

5) Exception message:  no such user:  Unable to locate user: {xx=cvb,xx=asdf,}}

 

the result should be:

errormessage                                                       total

Unable to find element with path.                total count of similar messages beside

please visit: www.testsel.com                     total count of similar messages beside

the user already exists                                     total count of similar messages beside 

we were unable to process you request.   total count of similar messages beside

Unable to locate user                                         total count of similar messages beside

 

PLease suggest a solution

Tags (2)
0 Karma

scelikok
Champion

Hi @REACHGPRAVEEN,

Please try below;

| eval errormsg=if(errormessages LIKE "user % not found","user not found","")
| stats sum(total) as total by errormsg
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!