Find Fields With Data in Class

Query

Search Repository: humio

logscale
wildcard(field=class,pattern="*Data*")
| groupBy(class)

Introduction

Find all events containing any Data string in their class, and count the occurrences for each class that is found. For example, it can be used to get a list of events that have items such as DataIngestRateMonitor, or LocalDatasource.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    wildcard(field=class,pattern="*Data*")

    Searches the incoming data to list all events having Data (and everything around it) in their string.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[/Filter/] 1{{Aggregate}} result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | groupBy(class)

    Takes the events extracted from the search and groups them by the class field.

  4. Event Result set.

Summary and Results

The result is an aggregated count of all events matching anything with Data (with one or more characters before or after), in the class field.

class_count
c.h.c.c.ChatterDataMemoryStatusLoggerJob$283
c.h.d.DataIngestRateMonitor$7504
c.h.d.LocalDatasource$10352
c.h.d.q.EmptyIdleDatasourcesCleaner3
c.h.e.e.Datasource$3947
c.h.e.e.Datasources$4
c.h.e.f.DataSnapshotOps$662
c.h.e.f.DataWithGlobal7254
c.h.j.CleanupDatasourceFilesJob141
c.h.j.DataSyncJobImpl$46594
c.h.j.DatasourceRehashingJob$32
c.h.k.ChatterDataDistributionKafka$107