I am trying to make an overview with different counts. The message always starts with :
Some will go in error and then they will apear with:
The difficult thing is that I want the unique ID's, so some messages will have an retry in both loggers.I tried to use dedup but then I will miss messages when they are in both loggers. I hope someone can make sense of my question....
search.... logger="blahblah-main.Start*" OR logger="blahblah.Exception" |dedup message.MessagId|dedup message.BusinessId |chart count by logger
@richgalloway is right - without real sample data, we're not going to be able to help you as well as we could otherwise
We need you to supply sample data
That said, here's a possible guess as to what you're trying to do:
index=ndx sourcetype=srctp logger="blahblah-main.Start" OR logger="blahblah.Exception" | stats values(message.MessageId) as MessageId values(message.BusinessId) as BusinessId by logger
Please share complete examples of error and non-error messages. Let us know where to find the MessageId and BusinessId fields.
Hi, you are absolutely right but I find it difficult to supply samples. The situation is that there is a chain of events, every event starts with the logger "start" when the event cannot be distrtibuted it ends in an exception. Every event contains a messageid en sometimes a businessid. The messageid is unique for every string of events, this can be 2 events of 100. In case of an error there will be retries with the same messageid. I need the count of the unique id's that have been started en the count of the id's that had an exception. Both dedupped.
Message.ID LOGGER LOGGER
1 “start” 2 “start” 3 “start” 3 "Exception" 3 "Exception" 4 "Start" 5 "Start" 5 "Exception" 6 "Start" 7 "Start"