Hello,
I want to display the total count of events and failed events count. In my case, it is determined by the field DETAIL
The following query does return the count by sourcetype "foo.bar.* and having error or exception.
index=myindex sourcetype=foo.bar.* DETAIL ="*error*" OR DETAIL ="*exception*"| stats count(UNIQUE_ID) as Fail by sourcetype
Sourcetype | Fail |
foo.bar.cat | 3 |
foo.bar.dog | 2 |
I tried to query using the following to determine total events for individual sourcetype and the fails for the same. But, the fails are always returned as zero.
index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | search index=myindex sourcetype=foo.bar* DETAIL ="*error*" OR DETAIL ="*exception*"|stats count(UNIQUE_ID) as Fail by src| fields sourcetype Total Fail
Sourcetype | Total | Fail |
foo.bar.cat | 153 | 0 |
foo.bar.dog | 128 | 0 |
I tried using subsearch for the below query, but this one doesn't even work at all.
index=myindex sourcetype=foo.bar*| eventstats count(UNIQUE_ID) as Total by sourcetype | stats count(eval( DETAIL ="*error*" OR DETAIL ="*exception*")) as fail values(Total) as Total by src | fields src Total fail
I appreciate your time and support!
Thanks!!
index=myindex sourcetype=foo.bar*
| eval status=case(like(DETAIL,"%error%"),"Fail",like(DETAIL,"%exception%"),"Fail",true(), "Success")
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail
Hi @vamshiverma , can you please try using above.
Regards,
Ankush
Thank you! @askkawalkar. It helped a lot. Awesome!😊
@vamshiverma , Kindly accept answer for question, which is most helpful, So that others can use it if required.
Regards,
Ankush
@vamshiverma , can you try below and see if you getting the desired results
index=myindex sourcetype=foo.bar.*
|eval type=if(DETAIL="*error*" OR DETAIL="*exception*","Fail","other")
|stats count(UNIQUE_ID) as Total sum(eval(status="Fail")) as Fail by sourcetype
Thank you !! @Nisha18789 , it's working. 😀
You may not need a subsearch. Try this query.
index=myindex sourcetype=foo.bar*
| eval status=if(searchmatch(DETAIL ="*error*" OR DETAIL ="*exception*"), "Fail", "Success")
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail
Sorry about that. Try this alternative.
index=myindex sourcetype=foo.bar*
| eval status=case(searchmatch(DETAIL ="*error*"), "Fail", searchmatch(DETAIL ="*exception*"), "Fail", 1==1, "Success")
| stats count(UNIQUE_ID) as Total, sum(eval(status="Fail")) as Fail by sourcetype
| fields sourcetype Total Fail
@richgalloway slick and smooth way to solve, thanks a lot!! 😊
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
@richgalloway Thank you for the reply, I appreciate it.
I tried to run the same query but it is throwing "Error in 'eval' command: The arguments to the 'searchmatch' function are invalid."