Splunk Search

Count Occurrence of string from raw log

andreacorrie
Explorer

I am trying to count occurrences of events from raw logs. Basically, if the log contains the string "MediaFailed", then count it. The difficulty is this string is not part of a key-value pair so I can't do an equality statement. I'm just looking for its existence within the entire log. I have tried the following, unsuccessfully:

| eval failures=case(match(_raw,"MediaFailed"),uuid)

Any help is appreciated!

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Something like this would work?

| eval failures=if(match(_raw,"*MediaFailed*"),1,0)
0 Karma

cpetterborg
SplunkTrust
SplunkTrust

You can just use the string "MediaFailed" as a part of your search, something like:

source=<whatever> "MediaFailed" | stats count

That will search it matching the case.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...