topic Re: How to get count of a field per event? in Splunk Search

How to get count of a field per event?

jameshgibson — Thu, 20 Sep 2012 10:08:06 GMT

I am using a transaction to get the start/end/duration of jobs. This gives me back about 200 events. Something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | table start, end, duration

I would like to extract the number of "tasks" that are done in in this job I use the "rex" command to get a the field:

rex field=_raw ".*(?<task>Task started).*" | stats count(task)

unfortunatly the stats command groups all the events which I dont want. I really want something like:

Re: How to get count of a field per event?

Ayn — Thu, 20 Sep 2012 10:25:53 GMT

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Re: How to get count of a field per event?

jameshgibson — Thu, 20 Sep 2012 10:52:53 GMT

doesn't do what I need, it just returns 1 or 0 depending if there are any tasks in the transaction

Re: How to get count of a field per event?

kristian_kolb — Thu, 20 Sep 2012 11:48:28 GMT

So you mean it's a distinct count? Then make a different field extraction through rex;

... | rex "(?.{20}).*Task started" | ...

In this case, grab the first 20 characters of your events as a unique task id (assuming there is a timestamp there - YMMV). This should do fine, if you don't really need to look a the actual values.

/kristian

Re: How to get count of a field per event?

jameshgibson — Thu, 20 Sep 2012 13:54:02 GMT

I just want a field count within each event. I dont care if the tasks are repeated or not.