index = aws_ubs_n | search log IN ("*error*","*info*","*warn*") | stats count as log

[surens]

How to count each log value separately?

("*error*","*info*","*warn*")

[surens]

Thanks It's working fine

[gcusello]

Hi @surens,

did you tried:

index = aws_ubs_n log IN ("*error*","*info*","*warn*") 
| stats count BY log

For more infos see at https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Stats

Don't use the search command after the main search, it's a best practice to put search conditions as left as possible to have faster searches.

Ciao.

Giuseppe

[surens]

I want know each log count 

like 

error log    23456

info             873267

 how ?

[gcusello · Accepted solution]

Hi @surens ,

ok, please try this:

index = aws_ubs_n log IN ("*error*","*info*","*warn*") 
| eval kind=case(like(log,"%error%"),"error",like(log,"%info%"),"info",like(log,"%warn%"),"warn")
| stats count AS Log_count BY kind

Ciao.

Giuseppe

[surens]

Now how to get this option in multiselect splunk dashboard ?

Field For Label?

log

Field For Value?

what would enter this place ?

[gcusello]

Hi @surens,

in a multiselect input, you could use a search like this:

index = aws_ubs_n log IN ("*error*","*info*","*warn*") 
| eval kind=case(like(log,"%error%"),"error",like(log,"%info%"),"info",like(log,"%warn%"),"warn")
| dedup kind
| sort kind
| table kind

and use the kind value both for label and value.

Or use fixed values.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉