HI,
I have events in splunk, where two fields description and msg denotes error messages. When I try to use to below. I tried renaming msg and description to same values but I am not getting an count.
index=work status=failure
| stats count by description
|appendcols
[search index=work tag=error
| stats count by msg]
I see below result:
Description Count msg
10 Account locked
Login failed 20
How can I get below?
Error Count
Account Locked 10
Login failed 20
Hi
have you tried this https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/ConditionalFunctions#coalesce.28X... before stats?
...
| eval err=coalesce(error,msg)
| stats count by err
r. Ismo
Hi
have you tried this https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/ConditionalFunctions#coalesce.28X... before stats?
...
| eval err=coalesce(error,msg)
| stats count by err
r. Ismo