Splunk Search

How do I consolidate the count of similar values in a table?

jonathanoberhau
New Member

I have a Search that looks at some XML responses from an API and should create a time chart by the count of each type of error message.

I have a query that produces that result, but the issue I have is the transaction deadlock errors all represent the same type of error, but show as distinct columns since they have a unique "Process ID".

alt text

What I would like to do is consolidate the various Transaction Deadlock columns into one column and have the total count of all deadlock errors.

Query thus far:

index=my_favorite_index  "message.location"="cancelContract"
| spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
| mvexpand ResponseMessages
| spath input=ResponseMessages
| timechart count by Text

Anyone have any ideas on how to accomplish this?

Tags (3)
0 Karma
1 Solution

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

View solution in original post

KailA
Contributor

Hi,

We can try to group all the transaction into the same field so you don't have a column by Process Id ! 🙂

index=my_favorite_index  "message.location"="cancelContract"
 | spath input=message.data.responseBody output=ResponseMessages path=soap:Envelope.soap:Body.CancelContractResponse.CancelContractResult.Messages.Message
 | mvexpand ResponseMessages
 | spath input=ResponseMessages
 | eval Text = if(like(Text,"Transaction%"),"Transaction",Text)
 | timechart count by Text

You should be able to group all the transaction with this query.
You can also add some parameters to the timechart function like that
| timechart limit=0 useother=false count BY Text, that should return you every error and not combine them under OTHER field.

Let me know if it works for you
KailA

View solution in original post

jonathanoberhau
New Member

I had to add the closing parenthesis for the like() function, then it worked great!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!