how to group similar messages into one message and get count of them

[REACHGPRAVEEN]

Example:  errormessages    total

                    user a not found.     7

                    user b not found.      5

                    user c not found.      10

Result should be : 

                    user not found.      22

[scelikok]

Hi @REACHGPRAVEEN,

I used your sample data. Using a similar method that I sampled, you should be able to convert to a unique value to make a sum. If there is another field in your logs like error_id you can use that field for grouping.

It is not easy without knowing your data. 

[REACHGPRAVEEN]

Thanks for the response. but i do have lot of messages with that criteria. in that case do we have to write for  each message like above

[REACHGPRAVEEN]

i have messages as below:

1) Exception message: {"errorMessage":"Unable to find element with pathh '//input[@type=text][@name='User']'",.........

2) error, please visit: www.testsel.com .  xxxxxx

3) error=the user xxxx already exists (more number of users are there)

4) error= we were unable to process you request {xx=cvb,xx=asdf,}

5) Exception message:  no such user:  Unable to locate user: {xx=cvb,xx=asdf,}}

the result should be:

errormessage                                                       total

Unable to find element with path.                total count of similar messages beside

please visit: www.testsel.com                     total count of similar messages beside

the user already exists                                     total count of similar messages beside 

we were unable to process you request.   total count of similar messages beside

Unable to locate user                                         total count of similar messages beside

PLease suggest a solution

[scelikok · Accepted solution]

Hi @REACHGPRAVEEN,

Please try below;

| eval errormsg=if(errormessages LIKE "user % not found","user not found","")
| stats sum(total) as total by errormsg