Splunk Search

Transaction

ncbshiva
Communicator

Hi

This is my search query
source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry".

Now i want to evaluate count of "Errors" word from the above result.

Please help me..........

Tags (1)
0 Karma
1 Solution

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

View solution in original post

ncbshiva
Communicator

This is the sample log

[M2E-CSI]2013-06-11 01:19:40,924 PDT - Hydra is starting Control Channel
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable
[M2E-CSI]2013-06-11 01:19:40,926 PDT - Error is adding AdapterJMS as Reconnectable

0 Karma

ChhayaV
Communicator

hi,
Append search Errors to your query

source="-----.log" | transaction startswith="DME2 Version" endswith="Published service endpoint successfully on registry" | search Errors | stats count

hope this helps

View solution in original post

ChhayaV
Communicator

hi,
if you will not use transaction simply right
source="-----.log" Error |stats count

you will get count as 5

0 Karma

ncbshiva
Communicator

Example i should get the count of "Error" word as 5

0 Karma

ncbshiva
Communicator

Please see the sample log and help me to get the count of "Error"

0 Karma

ncbshiva
Communicator

I am not getting proper count ........

0 Karma

linu1988
Champion

Please provide sample log.

0 Karma