Hi All i have been trying to capture the error split up and ratio from the following sample log event which probably needs a complex regex        { [-] cluster_id: us-prod-az-200 kubernetes: { [+] } log: { [-] appVersion: 0.1.326 envType: prod environment: prod-txn log: Request and Response, consumerId=xxxxxx-xxxx-xxxx, duration=144, correlationId=0-0-0, requestType=ItemDetails, requestIds=43947812:212001513:217953998:55079684:748708658:42068997:16875745:392480759:138021380:49984819:3933145:54016598:500257082:702903612:50179695:54056450, reqOfferIds=,requestPrimaryMap=, storeIds=0000, status=PARTIAL, responseSize=16, isCustomerAddressPresent=true, extPostalCode=null, fulfillmentIntent=, error=138021380=404.IMS.STORE100;500.IMS.PRICE.103:42068997=400.IMS.STORE.100:3933145=500.IMS.OFFER.100;404.IMS.PRICE.103:212001513=404.IMS.STORE.100:217953998=404.IMS.STORE.100;400.IMS.100:500257082=404.IMS.STORE.100, missingBadgeItems=138021380:702903612:55079684:49984819:54056450:3933145:217953998:392480759, pickupStoreIds= logLine: 93 methodName: Utils serverName: 11.16.251.37 time: 2023-02-27 14:43:33.999 timeStamp: 1677509013999 type: INFO } time: 2023-02-27T14:43:33.999844088Z       each event is unique with error attribute is multivalued field with delimiters for each id(only incase of error) or null as shown below, ex:  error=138021380=404.IMS.STORE100;500.IMS.PRICE.103:42068997=400.IMS.STORE.100:3933145=500.IMS.OFFER.100;404.IMS.PRICE.103:212001513=404.IMS.STORE.100:217953998=404.IMS.STORE.100;400.IMS.100:500257082=404.IMS.STORE.100, OR error=, my requirement is to compute each error code splitup and error ratio in a tabular fashion ratio=each error code count/total responseSize here responseSize is the number of ids passed in each request per event error count responseSize ratio 404.IMS.STORE100 aggregation of the error aggregate of responseSize round((count/responseSize)*100,2) 500.IMS.PRICE.103 aggregation of the error aggregate of responseSize   can someone please help to find a better way to have the error breakdown with ratio as per the above requirement i was trying to segregate the error split up and aggregating the responseSize but the search is not giving expected results while tabulating,       index=<index name> "log.envType"=prod "log.methodName”=“Utils” 
 | rex field=_raw "responseSize=*(?<responseSize>.+?),"
 | rex field=_raw ", error=*(?<errorMap>.+), missingBadgeItems" | eval errors0=replace(errorMap, "=", ";") | eval errors1=split(errors0,":") | rex field=errors1 "(?<errorCodes>.*)" | mvexpand errorCodes | eval code=split(errorCodes, ";") | mvexpand code | table code,responseSize       can someone please help..Thanks              ... View more

Hi All,  I am trying to tabulate the error ratio based on the following scenarios from the unique log event but further using the regex to split the error code causing the total events to be filtered out causing the overall hits to be incorrect while % calculation as the initial no of unique events is not getting preserved with eventstats  sample log event is in json format as below and multiple errorcodes in same log event which needs a error wise split log:<<field1>>,<<field2>>,<<field3>>,error=60KOANEWLH=500.EBS.SYSTEM.100:67MPW4X79FOJ=500.IMS.SERVEROUT.100:3534U6ZIZY39=500.EBS.SERVERIN.100;404.IMS.SERVEROUT.105:3M8TEWEKVIJK=500.IVS.XXXXX.100;404.IMS.XXXX.105:2ILTH9G0UMG1=500.IMS.XXXXXXXX.100:0UAQL48U2KWF=500.EBS.XXXXXXX.100;404.IMS.XXXXXXXXX.105, missingFulfillmentItems,<<field4>>,<<field5>>,<<field6>> i would like to get each error code % mainly (500.XX.XXXX.100 count/total hits)  below is the splunk search filter been used but not getting totalevents, please correct me if there is anything missed,,could someone please assist with an alternate option to compute the error trend..Thanks in advance index=<indexname> "Search String" "Type"=prod  | eventstats sum(index) as total_hits | rex field="log.log" ", error=*(?<errorMap2>.+), missingFulfillmentItems" | eval errors0=replace(errorMap2, "=", ";") | eval errors1=split(errors0,":") | rex field=errors1 "(?<errorCodes>.*)" | mvexpand errorCodes | eval errorCodes1=split(errorCodes, ";") | mvexpand errorCodes1 | where like(errorCodes1,"%500.IMS.%") | stats count by errorCodes1,total_hits Note: each log event is unique and has multiple error codes with in the event or no error codes in the event if its success ... View more