topic Splunk table and regex filter in Splunk Search

Splunk table and regex filter

mnjmht18 — Mon, 16 Dec 2019 19:05:17 GMT

I have following data in "log" field,
date1 name : message one
date2 name : message two
date3 name : message one
date4 name : message one
date5 name : message three
date6 name : message three

i want to filter this and create a table as below,
columns
log - count
message one - 3
message two - 1
message three - 2

how can i achieve this?

Re: Splunk table and regex filter

richgalloway — Mon, 16 Dec 2019 19:29:22 GMT

Try this query.

... | rex field=log "name : (?<log>.*)"
| stats count by log

Re: Splunk table and regex filter

vnravikumar — Tue, 17 Dec 2019 01:41:24 GMT

Hi @mnjmht18

Try any one of the following

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| rex field=log "name :\s+(?P<log>[^:]+)$" 
| stats count by log

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| eval log= mvindex(split(log,"name :"),-1) 
| stats count by log