Hello, I want to count the number of different messages and show them in a pie chart.
My data looks like the following:
Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b59c'. | 2
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b39c'. | 3
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain='test' | 1
CreateDomainConfiguration - domain='test' | 3
CreateDomainConfiguration - domain='test' | 6
Could not contact master for new replication information | 2
Now I want to group similar events based on the field value like this:
Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID | 5
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain | 10
Could not contact master for new replication information | 2
How can I achieve this? Thanks a lot!
This has worked for me.
... | eval Message=case(like(Message,"An error occurred while trying to unsubscribe service with Subscription ID%"), "An error occurred while trying to unsubscribe service with Subscription ID", like(Message, "CreateDomainConfiguration - domain%"),"CreateDomainConfiguration - domain", 1=1,Message)| stats sum(Count) as Count by Message | table Message Count
You may want to look at the cluster command in Splunk which "groups events together based on how similar they are to each other". See more details here.
https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Cluster
http://blogs.splunk.com/2014/07/28/splunk-command-cluster/
This has worked for me.
... | eval Message=case(like(Message,"An error occurred while trying to unsubscribe service with Subscription ID%"), "An error occurred while trying to unsubscribe service with Subscription ID", like(Message, "CreateDomainConfiguration - domain%"),"CreateDomainConfiguration - domain", 1=1,Message)| stats sum(Count) as Count by Message | table Message Count