Splunk Search

How to get the stats of multiple search string

ibob0304
Communicator

I am trying to get the stats for the search keywords. My query will list the errors by time but it wont tell me how many errors came for each search string.

index=main source=*event* | search "NETWORK error" OR "OPS error" OR "NETSTAT ERROR" | bucket span=5m _time | stats count by _time

woodcock
Esteemed Legend

Like this:

index=main source=*event* AND ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| timechart span=5m count AS total count(eval(searchmatch("NETWORK error")) AS network_error count(eval(searchmatch("OPS error")) AS ops_error count(eval(searchmatch("NETSTAT error")) AS netstat_error

aberkow
Builder
index=main source=*event* ("NETWORK error" OR "OPS error" OR "NETSTAT ERROR")
| eval searchString = case(like(_raw, "%NETWORK error%"), "Network Error", like(_raw, "%OPS error%"), "Ops Error",  like(_raw, "%NETSTAT error%"), "Netstat Error", 1==1, "Incorrect searchString match, please refactor")
| stats count by searchString

I just assumed you were using the _raw field for your search and moved it up into the main search, but the general idea is you want to use a field with a string match - either like, equals, match, etc (check out some options here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#like.28TEXT....) to create a field you can stats count by. You could do this in a bunch of other ways too, but I think this is the cleanest one.

Hope this helps!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...