https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362423#M107050 <P>I have the following search, which lists the complete path name of the file in field12:</P> <PRE><CODE>index="xxxxxxxxx" host=xxxxx abcservice complete AND *.doc* OR *.ppt* OR *.xls* </CODE></PRE> <P>Now I want to count the number of doc, ppt, xls type files. Is it possible that in a given search, it can conduct further search on field12 only and pick the last 3 or 4 characters (doc or docx) and count it?</P> Tue, 21 Mar 2017 09:26:55 GMT discoverneeraj 2017-03-21T09:26:55Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362423#M107050 <P>I have the following search, which lists the complete path name of the file in field12:</P> <PRE><CODE>index="xxxxxxxxx" host=xxxxx abcservice complete AND *.doc* OR *.ppt* OR *.xls* </CODE></PRE> <P>Now I want to count the number of doc, ppt, xls type files. Is it possible that in a given search, it can conduct further search on field12 only and pick the last 3 or 4 characters (doc or docx) and count it?</P> Tue, 21 Mar 2017 09:26:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362423#M107050 discoverneeraj 2017-03-21T09:26:55Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362424#M107051 <P>Based on the search above you should probably utilize the stats command. Also, you may need to create a field for this. Something such as Doctype. </P> <P>Once you have the field extraction in place you can run the stats command |stats count by Doctype</P> <P>Note that the field name will be case-sensitive. Below is the field extraction documentation:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> Tue, 21 Mar 2017 13:34:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362424#M107051 amahoski 2017-03-21T13:34:30Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362425#M107052 <P>why not extract a new field called "extension" for example and then do ... | stats count by extension?<BR /> you can also use the | rex command to create a field and then like mentioned above</P> Tue, 21 Mar 2017 13:43:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362425#M107052 adonio 2017-03-21T13:43:26Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362426#M107053 <P>Try something like this (assuming field 'field12' contains the file name/path where you're matching these extensions)</P> <PRE><CODE>index="xxxxxxxxx" host=xxxxx abcservice complete AND ( field12=*.doc* OR field12=*.ppt* OR field12=*.xls* ) | rex field=field12 "(?&lt;Extension&gt;\.\w{2,3,4})" | stats count by Extension </CODE></PRE> Tue, 21 Mar 2017 14:16:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362426#M107053 somesoni2 2017-03-21T14:16:08Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362427#M107054 <P>| rex field=field12 "(?.\w{2,3,4})" | stats count by Extension<BR /> added 4 incase you have extensions like .docx </P> Tue, 21 Mar 2017 14:41:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362427#M107054 adonio 2017-03-21T14:41:25Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362428#M107055 <P>Thanks @adonio, I meant to write <CODE>\w{3,4}</CODE> there. Updated the answer.</P> Tue, 21 Mar 2017 15:33:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362428#M107055 somesoni2 2017-03-21T15:33:43Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362429#M107056 <P>When I put this, I get the message "No results found", I will try to work on field extractor stuff as mentioned in </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/ExtractfieldsinteractivelywithIFX">http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/ExtractfieldsinteractivelywithIFX</A></P> <P>Thanks for taking out your time and replying to my query.</P> Wed, 22 Mar 2017 12:31:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362429#M107056 discoverneeraj 2017-03-22T12:31:58Z https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362430#M107057 <P>Try with just this as well</P> <PRE><CODE>index="xxxxxxxxx" host=xxxxx abcservice complete AND ( *.doc* OR *.ppt* OR *.xls* ) | rex "(?&lt;Extension&gt;\.\w{2,3,4})" | stats count by Extension </CODE></PRE> Wed, 22 Mar 2017 14:33:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-a-particular-string-in-the-searched-field/m-p/362430#M107057 somesoni2 2017-03-22T14:33:02Z