Splunk Search

stats count for a text value associated with a number

lazyturtle_
Explorer

Hi everyone,

I am stuck in a situation where in my app logs there are two important values(one is a number and other is a text string) are being captured and I need to draw a stats count using these two values.
so here is the base query:

index=Myapp sourcetype=weblogic "ReservationConfirmRS returned errors for TrainId"

| dedup requestId sortBy -_time | timechart count span=1d

the log looks like below:


ReservId=30010632019 billingCurrency=“INR”,Status=7000, Error='ReservationConfirmRS returned errors for TrainId 45732 and reference number null[The trxn could not been confirmed. Please try again. Cause: ]’,travelerType=3

so the 'TrainId' and text in bracket [text-string] would be different, and I need to draw a stats count for these two values.


Please help!

Labels (4)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @lazyturtle_,

Thank you, I think below will work for you;

| rex "ReservationConfirmRS\sreturned\serrors\sfor\sTrainId\s(?<TrainId>\d+).+\[(?<errorMsg>[^\]]+)"
| stats count by TrainId errorMsg
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @lazyturtle_,

Thank you, I think below will work for you;

| rex "ReservationConfirmRS\sreturned\serrors\sfor\sTrainId\s(?<TrainId>\d+).+\[(?<errorMsg>[^\]]+)"
| stats count by TrainId errorMsg
If this reply helps you an upvote and "Accept as Solution" is appreciated.

lazyturtle_
Explorer

Hi @scelikok ,

thanks a lot, this worked 🙂

0 Karma

scelikok
SplunkTrust
SplunkTrust

I meant the desired output, what you want to see as a result of these three events.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

lazyturtle_
Explorer

Hi @scelikok ,
the desired output should be like this:

TrainIderrorMsgCount
45732The trxn could not been confirmed. Please try again. Cause: 3
12411The trxn could not been confirmed. Please try again. Cause: 2
45732There is a Stop sale for TrainId: 12411,  fromDate: 2021-02-12, toDate: 2021-02-221
12411The trxn could not been confirmed. Please try again. Cause: 7
23765There was one error in the communication with the reservation system1
45732There was one error in the communication with the reservation system1
12411There was one error in the communication with the reservation system1


Thank you.



0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @lazyturtle_,

I think I couldn't get your need. Regex is extracting these values and calculates daily count.

If you can put a sample desired output table based on your last three sample data, I will try again.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

lazyturtle_
Explorer

ReservId=30010632019 billingCurrency=“INR”,Status=7000, Error='ReservationConfirmRS returned errors for TrainId 45732 and reference number null[The trxn could not been confirmed. Please try again. Cause: ]’,travelerType=3

 

 

ReservId=30010632020 billingCurrency=“INR”,Status=6000, Error='ReservationConfirmRS returned errors for TrainId 12411 and reference number null[There is a Stop sale for TrainId: 12411,  fromDate: 2021-02-12, toDate: 2021-02-22]',travelerType=2

 

 

 

ReservId=30010632021 billingCurrency=“INR”,Status=7000, Error='ReservationConfirmRS returned errors for TrainId 23765 and reference number null[[There was one error in the communication with the reservation system]',travelerType=3

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @lazyturtle_,

Please try below;

| rex "ReservationConfirmRS\sreturned\serrors\sfor\sTrainId\s(?<TrainId>\d+).+\[(?<text_string>[^\]]+)"
| timechart span=1d count(TrainId) TrainId count(text_string) as text_string
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

lazyturtle_
Explorer

hi @scelikok ,
I tried your solution but that didn't give me the desired out put, as I said in the error message the 'TrainId' and error string in the bracket could be different, some of the examples below:

- ReservationConfirmRS returned errors for TrainId 12411 and reference number null[There is a Stop sale for TrainId: 12411,  fromDate: 2021-02-12, toDate: 2021-02-22]

- ReservationConfirmRS returned errors for TrainId 12973 and reference number null[The trxn could not been confirmed. Please try again. Cause: ]'

- ReservationConfirmRS returned errors for TrainId 23765 and reference number null[[There was one error in the communication with the reservation system]





lazyturtle__0-1613103377688.png

 








0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...