Splunk Search

How to count valid and invalid requests at the same time?

vamshiverma
Explorer

Hello,

I want to display the total count of events and failed events count. In my case, it is determined by the field DETAIL

The following query does return the count by sourcetype "foo.bar.* and having error or exception.

 

 

index=myindex sourcetype=foo.bar.* DETAIL ="*error*" OR DETAIL ="*exception*"| stats count(UNIQUE_ID) as Fail by sourcetype

 

 

SourcetypeFail
foo.bar.cat3
foo.bar.dog2

 

 

I tried to query using the following to determine total events for individual sourcetype and the fails for the same. But, the fails are always returned as zero.

 

 

 

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | search index=myindex sourcetype=foo.bar*  DETAIL ="*error*" OR DETAIL ="*exception*"|stats count(UNIQUE_ID) as Fail by src| fields sourcetype Total Fail

 

 

SourcetypeTotalFail
foo.bar.cat1530
foo.bar.dog1280

 

I tried using subsearch for the below query, but this one doesn't even work at all.

 

 

index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | stats count(eval( DETAIL ="*error*" OR DETAIL ="*exception*")) as fail values(Total) as Total by src | fields src Total fail

 

 

 

I appreciate your time and support!

Thanks!!

Labels (4)
0 Karma

askkawalkar
Path Finder
index=myindex sourcetype=foo.bar*
| eval status=case(like(DETAIL,"%error%"),"Fail",like(DETAIL,"%exception%"),"Fail",true(), "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail

Hi @vamshiverma , can you please try using  above. 

 

Regards,

Ankush

 

vamshiverma
Explorer

Thank you! @askkawalkar. It helped a lot. Awesome!😊

0 Karma

askkawalkar
Path Finder

@vamshiverma , Kindly accept answer for question, which is most helpful, So that others can use it if required. 

Regards, 

Ankush

0 Karma

Nisha18789
Builder

@vamshiverma , can you try below and see if you getting the desired results

index=myindex sourcetype=foo.bar.*
|eval type=if(DETAIL="*error*" OR DETAIL="*exception*","Fail","other")
|stats count(UNIQUE_ID) as Total sum(eval(status="Fail")) as Fail by sourcetype

 

 

 

 

vamshiverma
Explorer

Thank you !! @Nisha18789  , it's working. 😀

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You may not need a subsearch.  Try this query.

index=myindex sourcetype=foo.bar*
| eval status=if(searchmatch(DETAIL ="*error*" OR DETAIL ="*exception*"), "Fail", "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Sorry about that.  Try this alternative.

index=myindex sourcetype=foo.bar*
| eval status=case(searchmatch(DETAIL ="*error*"), "Fail", searchmatch(DETAIL ="*exception*"), "Fail", 1==1, "Success") 
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail
---
If this reply helps you, Karma would be appreciated.

vamshiverma
Explorer

@richgalloway   slick and smooth way to solve, thanks a lot!! 😊

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vamshiverma
Explorer

@richgalloway Thank you for the reply, I appreciate it.

I tried to run the same query but it is throwing "Error in 'eval' command: The arguments to the 'searchmatch' function are invalid."  

 

sasd.PNG

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...