Hello all,
I am trying this search but it's not working.
Only the first match count is returned.
index=abc* sourcetype=applogfile
| eval _rawtext=_raw
| eval P_ErrMsg=case(_rawtext LIKE "%conflict%", "FKEY1", _rawtext like "%FOREIGN KEY%", "FKEY",_rawtext like "%nonexistingvalue%","garbagevalue")
| stats count by P_ErrMsg
1) Case
, in pretty much all languages, is equivalent to a nested if-then
structure. You don't get multiple answers.
2) There is no reason to copy the data from _raw
to _rawtext
.
3) A simple rex will pull what you need, then you can change the values after the stats
command.
index=abc* sourcetype=applogfile
| rex "(?<P_ErrMsg>conflict|FOREIGN KEY|nonexistingvalue)" max_match=0
| eval P_ErrMsg=mvdedup(P_ErrMsg)
| stats count by P_ErrMsg
| eval P_ErrMsg=case(P_ErrMsg=="conflict", "FKEY1",
P_ErrMsg=="FOREIGN KEY", "FKEY",
P_ErrMsg=="nonexistingvalue","garbagevalue")
@maniishpawar, can you please add some sample data where Only the first match count is returned
?
| makeresults
| eval _raw="some conflict while finding FOREIGN_KEY"
| append
[| makeresults
| eval _raw="Event with nonexistingvalue"]
| eval P_ErrMsg=case(searchmatch("conflict"), "FKEY1"
,searchmatch("FOREIGN KEY"), "FKEY"
,searchmatch("nonexistingvalue"),"garbagevalue")
| stats count by P_ErrMsg
As @DalJeanis has mentioned you should avoid a command like | eval _rawtext=_raw
to copy raw data over from one field to another. Alternative to Dal's approach, you can also try searchmatch()
function which matches your criteria against the _raw data. Splunk Documentation for reference: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#searchmatch....
PS: Pipes with | makeresults
and | append
are used to generate some mock data. You would need to replace with your base search. Also it is better id you added your own mocked up sample events (with sensitive information masked or anonymized
)
| makeresults
| eval _raw="some conflict while finding FOREIGN_KEY"
| append
[| makeresults
| eval _raw="Event with nonexistingvalue"]