How do you count the number of events in a transaction?

[wissenaire17]

I need to count the number of particular events in a transaction. Here, I NEED to count the number of tickets that have failed:

[2018-11-16 16:59:45 0665 - Scanned barcode: EndOfTicketBarcode, 2705600009993 (Referrer=2705600009993, POSNumber=056, Checksum=3) 
2018-11-16 16:59:54 0003 - Send ticket failed 
2018-11-16 17:00:06 1833 - Send ticket failed 
2018-11-16 17:00:52 8165 - BLClient :: Connected to 84.10.32.2:8091],

[mstjohn_splunk]

Hi @wissenaire17,

Did either of the answers below solve your problem? If so, please resolve this post by approving the one that helped you! If your problem is still not solved, keep us updated so that someone else can help. Thanks for posting!

[MathiasLindblom]

As mentioned, there are multiple ways to interpret your question, this it my interpretation:
The original question is an example of the log and you want to see how many "Send ticket failed" it contains.
In the example below I use |rex command to extract the timestamp for each "Send ticket failed" (max_match unlimited). Then you can simply count the values in Fails:

<insert base search>
| rex field=_raw "(?P<Fails>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}\s\d{4})\s-\sSend ticket failed" max_match=0
| eval NrOfFails=mvcount(Fails)
| table _time Referrer Fails NrOfFails

Hope this helps if the answer from @acharlieh didn't work for you!

[acharlieh]

There's multiple ways to interpret your request here.... the first being you're looking for the number of times you have an event of "Send ticket failed" which of course is rather simple

index=whatever sourcetype=yep "Send ticket failed" | stats count

However you mention transaction... which could mean that you're using the transaction command, which as the document says for each transaction that is assembled it leaves a field of eventcount