I have the following Splunk base search:
sourcetype=serverA FATAL OR ERROR OR WARN | rex field=_raw max_match=1 "(?<error_type>WARN|ERROR|FATAL)" | rex field=_raw "] (?<error_location>.*?) " | rex field=_raw "\) (?<description>.*)"
I then pipe this result to | eventstats count by error_type to get individual counts of each error type. Finally, I also want to return a set of description for each of the three error_types, whose number of results is reliant on the count for each error_type. For example, if the count of WARN is greater than 5, then it would only grab the first 5 descriptions. If the count is less, it would show them all.
I'm trying a syntax like this with no luck so far:
sourcetype=GRServerPROD_B FATAL OR ERROR OR WARN | rex field=_raw max_match=1 "(?<error_type>WARN|ERROR|FATAL)" | rex field=_raw "] (?<error_location>.*?) " | rex field=_raw "\) (?<description>.*)"| eventstats count by error_type | eval description_set=if(count>5, <return top 5 descriptions>, <return all descriptions>) | stats values(description_set) as descriptions, values(count) as count by error_type
I also tried running sub-searches using map but this seemed pretty lengthy.
... View more