Adding Multiple Expressions to Single Searchmatch in Splunk Query
I Am Trying to Add Two Different Expressions in the Searchmatch in Below Query Using Timechart but Its Giving Me Error. Can Any One Help Me out with the Same...
I am trying to add two different expressions in the searchmatch in below query using timechart but its giving me error. Can any one help me out with the same
Its like the count2 should increase if either of expression i.e. Expr2 or Expr3 is seen.
count1 is coming correct and count2 is giving issue as incorrect
index="abc" sourcetype="kube:container:abc_app" source="/var/log/containers/abc-env-*"
| timechart count(eval(searchmatch("Expr1"))) as "count1", count(eval(searchmatch("Expr2" OR "Expr3"))) as "count2"
2 Answers
The searchmatch function takes a single string (possibly containing a pattern) as its argument, not a boolean expression. Try using two searchmatch calls.
index="abc" sourcetype="kube:container:abc_app" source="/var/log/containers/abc-env-*"
| timechart count(eval(searchmatch("Expr1"))) as "count1", count(eval(searchmatch("Expr2") OR searchmatch("Expr3"))) as "count2"
You can only have a single aggregating function in a timechart call
You're trying to do two count functions
timechart will only do one
Marcus Vance is a cybersecurity auditor and technology writer dedicated to educating the public about online safety, data privacy regulations, enterprise security, and emerging cyber threats.
