CODEWITHSUNDEEP
splunksplunk-querysplunk-calculation
Sandeep muthyapu
Sandeep muthyapu

Reputation: 401

Query to find the unique code in splunk

can some one suggest a query to send the unique errorcode count.

Example enter image description here 2006

in between the tags(in place of 2006) different codes are printed i need to query to pull all the unique error codes

Upvotes: 0

Views: 823

Answers (1)

pjnike
pjnike

Reputation: 181

You can use the rex command to extract the desired values. It will look something like this:

your_initial_query
| rex field=_raw "<com:errorCode>(?<code>.*)<\/com:errorCode>"
| stats count by code

The second line tells rex to extract everything between the errorCode tags and save that to a field called code. You can then use the stats command to count the number of times a code is seen.

Upvotes: 1

Related Questions