We have logs in splunk with field level=ERROR OR INFORMATION OR CRITICAL , we want to do a stats on the count of (ERROR OR CRITICAL ) events and INFORMATION events.
Basically we want to see the ratio of INFORMATION events by NON INFORMATION events per app.
You base search is wrongly grouped for level field filter if it's same as what you posted in the question. All level field fields should be applied with ORed list as you want to select events with all three values of field level. You current search looks for level=Information
AND level=Error or level=Critical
and it's not possible as level can't have two values in the same event. Try like this
index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | stats count(eval(if(level!="Information",1,null))) as ErrorCount count(eval(if(level="Information",1,null))) as InfoCount by hdr.appName
Another option
index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | chart count over hdr.appName by level
| rename Information as InfoCount | eval ErrorCount=Error+Critical | table hrd.appName ErrorCount InfoCount
You base search is wrongly grouped for level field filter if it's same as what you posted in the question. All level field fields should be applied with ORed list as you want to select events with all three values of field level. You current search looks for level=Information
AND level=Error or level=Critical
and it's not possible as level can't have two values in the same event. Try like this
index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | stats count(eval(if(level!="Information",1,null))) as ErrorCount count(eval(if(level="Information",1,null))) as InfoCount by hdr.appName
Another option
index=servers sourcetype=json app=* (level=Error OR level=Critical OR level=Information) | chart count over hdr.appName by level
| rename Information as InfoCount | eval ErrorCount=Error+Critical | table hrd.appName ErrorCount InfoCount
I changed my search to exclude the level, still it is not showing any values other than 0. But your second search worked well.
I wrote a query like this :
index=servers sourcetype=json app=* level=Error OR level=Critical level=Information | stats count(eval(if(level!="Information",1,null))) as ErrorCount count(eval(if(level="Information",1,null))) as InfoCount by hdr.appName
but it displays 0 for all the counts of ErrroCount and InfoCount, whereas i had the matching events.
changed it to stats count(eval(level!="Information")) as ErrorCount count(eval(level="Information")) as InfoCount by appName, still showing 0 for everything.
can you try this:
index=servers sourcetype=json|stats count(eval(level!="Information")) as ErrorCount count(eval(level="Information")) as InfoCount by appName
still returns 0 for everything.