I have multiline events that contain anywhere from 1 to 30 status codes per event. For example:
status = success
status = success
status = failed
status = success
By default, I get a single field called "status" that contains a count of how many times "success" occurred and how many times "failed" occurred.
I would like to have two separate numerical fields, one called success_count
and the other called failed_count
that contain a count of how many times each value of the "status" field occurred per event (i.e. success_count=3
, failed_count=1
in this example).
I have tried:
| stats count(eval(status="success")) as success_count, count(eval(status="failed")) as failed_count
However, the resulting counts appear to be the number of events that contain success_count
and the number of events that contain failed_count
, rather than a total count of all the field value occurrences for status=failed
and status=success
within each event.
Any help would be greatly appreciated!
Assuming you have a mutivalue field called status the below (untested) code might work.
.. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count
Hi @masonmorales
Just following up with this question, but did @ramdaspr's answer below help solve your question? If yes, please resolve this post by clicking "Accept" directly below the answer. If you found another solution that did work, please share. Thanks!
Assuming you have a mutivalue field called status the below (untested) code might work.
.. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count