Splunk Search

stats count or eval

Path Finder

I am trying to make an overview with different counts. The message always starts with :


Some will go in error and then they will apear with:

The difficult thing is that I want the unique ID's, so some messages will have an retry in both loggers.I tried to use dedup but then I will miss messages when they are in both loggers. I hope someone can make sense of my question....

search.... logger="blahblah-main.Start*" OR logger="blahblah.Exception" |dedup message.MessagId|dedup message.BusinessId |chart count by logger

Labels (2)
Tags (2)
0 Karma


@richgalloway is right - without real sample data, we're not going to be able to help you as well as we could otherwise

We need you to supply sample data

That said, here's a possible guess as to what you're trying to do:

index=ndx sourcetype=srctp logger="blahblah-main.Start" OR logger="blahblah.Exception"
| stats values(message.MessageId) as MessageId values(message.BusinessId) as BusinessId by logger
0 Karma


Please share complete examples of error and non-error messages. Let us know where to find the MessageId and BusinessId fields.

If this reply helps you, Karma would be appreciated.

Path Finder

Hi, you are absolutely right but I find it difficult to supply samples. The situation is that there is a chain of events, every event starts with the logger "start" when the event cannot be distrtibuted it ends in an exception. Every event contains a messageid en sometimes a businessid. The messageid is unique for every string of events, this can be 2 events of 100. In case of an error there will be retries with the same messageid. I need the count of the unique id's that have been started en the count of the id's that had an exception. Both dedupped.


1           “start”
2        “start”
3        “start”
3                              "Exception"
3                              "Exception"  
4       "Start"
5        "Start"        
5                               "Exception"     
6   "Start"
7   "Start"
0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...