Hi
I have a log file , i want to search events for first occurrence of word "error" in that file, till the first occurrence of word "READY TO ACTIVATE".
I want to list all the events between first occurrence of "error" and first occurrence of "READY TO ACTIVATE".
Please help me ..........
Using transaction
like Ayn suggests; you'll get multivalued fields. Assuming that you have a field called 'status' which in your case contains either 'error' or 'ok', you could do (after the transaction)
| eval err = mvfilter(match(status, "error")) | eval err_count = mvcount(err)
If all the events in the transaction contains status=error
, you could use the eventcount
field that is created by the transaction
. Perhaps subtract 1 from the eventcount, if the 'READY TO ACTIVATE' event does not contain 'error'.
Without sample events, it is a lot harder to give you good advice.
/K
Hi kristian.kolb
I am not getting the count of word "error" correctly, If there are two "error" words in the log file , its giving the count as one only....
please help me....
Use transaction
.
... | transaction startswith="error" endswith="READY TO ACTIVATE"
i have used the same, but i need to evaluate the count of "error" from line 1 till the first occurrence of "READY TO ACTIVATE"
Thanks in advance.......
Hi
I have a log file , i want to evaluate count of errors from line 1 of the file till the first occurrence of "READY TO ACTIVATE" phrase.
Please help me ..........