topic Re: how to search using subsearch of occurence of a value in Splunk Search

how to search using subsearch of occurence of a value

VikashSharma47 — Mon, 24 May 2021 08:13:42 GMT

Hi Team,

I have a search query that searches for checking the busy tread and showing their occurrence in the log the value I need to print in the Splunk dashboard. We need printing bsy value beside the bsy like bsy 1,bsy 2 so we want to print those 1,2 value.

Attached the image for reference

@scelikok @gcusello and all Splunk enthusiastic please help

Re: how to search using subsearch of occurence of a value

ITWhisperer — Mon, 24 May 2021 09:12:06 GMT

| rex "(?<bsy>bsy \d+)"

Re: how to search using subsearch of occurence of a value

VikashSharma47 — Mon, 24 May 2021 11:10:48 GMT

Hi @ITWhisperer ,

I tried your given solution but it doesn't affect anything in the search. My ask is to fetch the result from the result. Actually, I need to print that bsy value which is beside it, and count for it. Attach the image for your reference. Anyway thanks a lot for looking into my queries. The result shows here in the image as bsy 3 so I need that 3 value has to printed.

Re: how to search using subsearch of occurence of a value

ITWhisperer — Mon, 24 May 2021 11:15:04 GMT

I have a space in my rex expression which you don't appear to have. Perhaps being more explicit about the space might help

| rex "(?<bsy>bsy\s\d+)"

Re: how to search using subsearch of occurence of a value

VikashSharma47 — Tue, 25 May 2021 01:53:08 GMT

Thanks @ITWhisperer , It's working