Splunk Search

deduct the count value of same filed with different values and show the difference value only in Pie chart

splunkvickyloui
Explorer

Hi,

My Log file has lot of error codes like ABC-12, ABC-15, ABC-28, ABC-43.... etc., Those errors may be duplicated. I have eliminated the duplicate with DEDUP as below.

In case of some transaction, occurrence on any DB error (which is ABC-15) in turn returns ABC-28 as per existing code behavior. So, whenever ABC-15 will occur ABC-28 is also getting printed in the logs. Hence we are getting wrong counts in Splunk for ABC-28. This deviation has to be corrected by ABC-28=(ABC-15 counts - ABC-28) OR ABC-28=(ABC-28 – ABC-15)(whichever is greater).

So the difference between the number of error code ABC-15 & ABC-28 will be the final value count for error code ABC-28

The below search query gives me the Error code counts for all the error codes except ABC-15 in pie chart. but the value of ABC-28 should have only the difference. how to get that?

source=my_app_log_prod_node* | rex field=_raw "(?(ajp-\d+.\d+.\d+.\d+-\d+-\d+))\sFinal\sDB\sErrorCode:(?\w+-\d+)" | dedup Transaction_ID Final_DB_Errorcode| search Final_DB_Errorcode!=ABC-15 | stats count by Final_DB_Errorcode | eval Final_DB_Errorcode=Final_DB_Errorcode. "(Count : " .count + ")"

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

source=my_app_log_prod_node* | rex field=_raw "(?<transaction_id>(ajp-\d+\.\d+\.\d+\.\d+-\d+-\d+))sFinalsDBsErrorCode:(?<final_db_errorcode>\w+-\d+)" | dedup Transaction_ID Final_DB_Errorcode | eventstats count(eval(Final_DB_Errorcode="ABC-15")) as CountABC15| search Final_DB_Errorcode!=ABC-15 | stats count first(CountABC15) as CountABC15 by Final_DB_Errorcode | eval Final_DB_Errorcode=if(Final_DB_Errorcode="ABC-28",if(count>CountABC15,count-CountABC15,CountABC15-count),Final_DB_Errorcode)| eval Final_DB_Errorcode=Final_DB_Errorcode. "(Count : " .count + ")"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...