Splunk Search

Counting xml tags in raw event

ajaysamantbms
Explorer

my event records are xml based as shown below coming in from one file, one sourcetype-
12........
..... // inside transaction tag i can contain anything
.....
.....
.....
.....
.....
.....
I am able to extract child tags inside each one - thats not an issue.
But how do i count how many records were of type Transaction and how many were of type Error.

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try following

sourcetype=gatewaylogs1 |  rex "^\<(?<eventType>[^\>]+)" | stats count by eventType

This should give your count of event for transaction/error.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try following

sourcetype=gatewaylogs1 |  rex "^\<(?<eventType>[^\>]+)" | stats count by eventType

This should give your count of event for transaction/error.

0 Karma

lguinn2
Legend

Try this

sourcetype=gatewaylogs1 "<transaction>" OR "<error>" 
| eval type=case (match(_raw,"\<transaction\>", "Transaction",  match(_raw,"\<error\>", "Error")
| stats count by type

if the transaction contains an XML error field, it will be counted only as a transaction, not as an error

0 Karma

lguinn2
Legend

Well, your search isn't filtering out anything, so it will certainly have all the events from gatewaylogs1. I have updated the search. But not sure yet if it will work.

0 Karma

ajaysamantbms
Explorer

Tried this

sourcetype=gatewaylogs1 | eval type=case ( match(_raw,"<error>"), "Error", match(_raw,"<transaction>"), "Transaction" ) | stats count by type

No errors...but no output..all it says 16 events..shows number of events..16 events (before 12/16/13 11:25:23.000 AM ) but no output in Statistics tab

And 16 is total events including events that has tags which i wanted to filter..so this query is really not doing anything..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

how are you extracting fields? Using regular expression for each field or using spath?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...