Splunk Search

How to analysis the occurrence of an ERROR on a give field with some other field?

brober27
New Member

I have a log, and in theis log I have a field that I have called Informative. This Informative can assume the following values : INFO, WARNING, ERROR, DEBUG.
My question is : how can I analyse the occurrence of the value ERROR in theis field with some other fiel value?
Should I use correlat, associate, contingency command? or something else?
How to misure the degree of cooccurence between the value ERROR and something else to discover some causes?
PLEASE HELP ME!
Thank BYe

Tags (1)
0 Karma

MousumiChowdhur
Contributor

Hi brober27,

It would be better if you can provide sample logs to provide you with exact query but meanwhile you can take the reference of the below query to identify the error message with that specific error in your log. The below query is specifically for ERROR from splunk internal log.

index=_internal log_level=ERROR | rex "(ERROR)\s+(?P<ErrorMessage>.*)" | stats count by log_level ErrorMessage

You can add your own index name, rex and log level field name in the above search query.

0 Karma

deepashri_123
Motivator

Hi brober27,

Do u want to check the count of events with specific condition AS ERROR AND say X together?
In that case your query can be something like this:
index=* (ERROR AND X) | stats count

Let me know if this helps!!

0 Karma

brober27
New Member

No. This way you must fix the value of X. You do not know a priori a value or a field. What I want is a result which report me the most probable cooccurrence field values.
Thank

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...