Hello,
I have this search results:
Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}
I'm trying to get the number of each each _errorCode for each user flow.
I started with
index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | stats count as ErrorCount by user_flow
I was able to get the number of error occurrences under each user flow. I wanted to expand this query to be more granular and include the error code so I would have:
UserFlow
ErrorCode
Error Count
AAAA
X
5
AAAA
Y
7
BBBB
F
1
BBBB
G
2
This is the query I came up with but the statistics tab are no longer showing anything
index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | rex field=_raw "_errorCode:\\\":(?<error_code>\d+)" |stats count as ErrorCount by user_flow, error_code
I see the events tab are still populated with search results but it looks like my addition to the query is not quite correct.
... View more
