topic Stats by custom string in Splunk Search

Stats by custom string

dv2323 — Fri, 10 Jul 2020 14:20:17 GMT

I'd like to display stats based on a custom string within a log entry. Below is sample of the log entry. I'd like to parse the unique entries seen after "The following DAP records were selected for this connection:" string. If possible use the stats by .... method so it displays a unique entry with the amount of times it's been seen. So in the case of the 2 entries below, the stats would have TEST_AUTOMATION_VENDOR, and TEST2_AUTOMATION_VENDOR with a count next to it. I can do this for VPN users quite easily, but can't figure out how to do it for unique results of a string. I only know the basics of splunk search syntax so hopefully I'm explaining this clearly.

%ASA-dap-6-734001: DAP: User TESTUSER, Addr 10.10.10.10, Connection AnyConnect: The following DAP records were selected for this connection: TEST_AUTOMATION_VENDOR

%ASA-dap-6-734001: DAP: User TESTUSER2, Addr 12.12.12.12, Connection AnyConnect: The following DAP records were selected for this connection: TEST2_AUTOMATION_VENDOR

Re: Stats by custom string

livehybrid — Fri, 10 Jul 2020 14:59:15 GMT

Hi @dv2323 You can use the rex command to extract the DAP record and then use stats, something like this:

index=your_index sourcetype=your_sourcetype | rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[A-Z_]+)" | stats count by dap_record

I hope this helps!

Re: Stats by custom string

dv2323 — Fri, 10 Jul 2020 15:07:14 GMT

Thank you that is very close to what I'm looking for! It's working, however it's only giving me partial names, and single Letter results. I'm thinking maybe the regex piece of [A-Z_]+ needs to be adjusted to include an entire dap record?

Re: Stats by custom string

rbar16 — Fri, 10 Jul 2020 15:36:37 GMT

@dv2323 Replace [A-Z_]+ with ".+" or ".*". You can also add an anchor "$" for end of line after the cap group if desired.

(?<dap_record>.+)$

Re: Stats by custom string

livehybrid — Fri, 10 Jul 2020 15:40:57 GMT

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits..

index=your_index sourcetype=your_sourcetype | rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+) | stats count by dap_record

Let me know how you get on! Fingers crossed!

Will

Re: Stats by custom string

dv2323 — Fri, 10 Jul 2020 16:13:06 GMT

This works well. Thank you.

Re: Stats by custom string

dv2323 — Fri, 10 Jul 2020 16:13:53 GMT

This works well. Gives me just the full DAP name, and count. Thank you.