https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434222#M167047 <P>@493669 <BR /> I think one of the issue is our Prod defaulting the view to "List" view instead of raw view. This is one of the reason that I might not getting the actual hit or stats based on the query we both have.</P> <P>Any idea on how I can indicate that I should be in "raw" result mode?</P> <P>Below is a sample list view as default mode coming up to our prod splunk - picture that value with processingStatus field.<BR /> <A href="https://answers.splunk.com/storage/temp/256156-json.jpg">https://answers.splunk.com/storage/temp/256156-json.jpg</A> <BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5954iE33DE8AA93687085/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 19 Oct 2018 17:16:49 GMT elheffe 2018-10-19T17:16:49Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434218#M167043 <P>I've read a few posts here already but hoping to clarify some items that I have. I need regex (rex) a raw or list msg then perform a "stats count by field" on that field found. </P> <OL> <LI>When i login to splunk the view is defaulted to "<STRONG>List</STRONG>" results vs <STRONG>Raw</STRONG> results. Is this the default in spunk-cloud? Not that it matters to me but probably it matters when I create my Search in my Dashboard?</LI> <LI>When I try to perform rex, I can't get the exact field that I need to do a stats count by that field and value that I need</LI> <LI>The field that I need is "processingStatus”:”BIDDING_STARTED” then do stats count on this key, value. I think the List vs Raw view is throwing off the way rex is used? Any other recommendations?<BR /></LI> <LI>Do I need to set something to stick to a certain view?</LI> </OL> <P>Thanks!</P> <P><STRONG>LIST VIEW:</STRONG> (with escape characters)<BR /> \"processingStatus\":\"BIDDING_STARTED\"</P> <P><STRONG>RAW VIEW:</STRONG><BR /> msg: 2018-10-11 15:32:07.973 INFO 14 --- [aaa-8080-exec-6] a.b.c.shoppingCartController : Response = [{"resourceId”:”f133b31e0-1234-1234-1234-rt1204bf8122”,”customerId":4194562,"consumerKey":"f133b31e0-1234-1234-1234-rt1204bf8122","externalId":"SHOEX:201810090738498037101234: 201810090738498037101234","shoes":{"relativeId":"f133b31e0-1234-1234-1234-rt1204bf8122","externalId":"SHOEX:521900”,”name":"VaporFly","gender":"MALE","year":1,"birthDate":{"year”:2018,”month”:9,”day":1},"classification":{"model":"Runnning","brand":"NIKE","environment":"Road"},"classifications":{"model":"Runnning","brand":"NIKE","environment":"Road"}},"person":{"relativeId":"5e3b69e5-8586-4bbf-99fd-a42f38609c0b","externalId":"SHOEX:568156","name":{"first":"Kipchoge","last":"Eliud"},"postalAddresses":[{"parentResourceId":"5e3b69e5-8586-4bbf-99fd-a42f38609c0b","streetAddress":["123 INTERNATIONA PKWY"],"city":"New York","state":{"name":"New York","code”:”NY”},”postalCode”:”12345”,”country":{"name":"UNITED STATES","iso2code":"US","iso3code":"USA","system":"<A href="http://abc-open.org/iso/3166/%22%7D%7D%5D,%22electronicAddresses%22:%5B%7B%22parentResourceId%22:%22f133b31e0-1234-1234-1234-rt1204bf8122%22,%22address%22:%22Kipchoge1@gmail.com%22%7D%5D,%22phoneNumbers%22:%5B%7B%22parentResourceId%22:%22f133b31e0-1234-1234-1234-rt1204bf8122%22,%22countryCallingCode%22:%221%22,%22number%E2%80%9D:%E2%80%9D1232131234%E2%80%9D,%E2%80%9Dextension%22:%22%22,%22capabilities%22:%7B%22fax%22:false,%22voice%22:true,%22text%22:false%7D%7D%5D%7D,%22practitioner%22:%7B%22relativeId%22:%22f133b31e0-1234-1234-1234-rt1204bf8122%22,%22externalId%22:%22SHOEX:1%22,%22name%22:%7B%22first%E2%80%9D:%E2%80%9DPATRICK%E2%80%9D,%E2%80%9Dlast%E2%80%9D:%E2%80%9DEVANS%E2%80%9D%7D,%E2%80%9DclinicName%22:%22SHOEX%22,%22phoneNumbers%22:%5B%7B%22countryCallingCode%22:%221%22,%22number%E2%80%9D:%E2%80%9D1231231234%E2%80%9D,%E2%80%9Dextension%22:%22%22,%22capabilities%22:%7B%22fax%22:false,%22voice%22:true,%22text%22:false%7D%7D%5D%7D,%22shopping%22:%7B%22relativeId%22:%22f133b31e0-1234-1234-1234-rt1204bf8122%22,%22shippingMethod%22:%22STANDARD%22%7D,%22prescription%22:%7B%22relativeId%22:%22f133b31e0-1234-1234-1234-rt1204bf8122%22,%22product%E2%80%9D:%7B%E2%80%9Caac%E2%80%9D:%E2%80%9D0987778769%E2%80%9D,%E2%80%9DconsumerSku%22:%222976672%E2%80%9D,%E2%80%9DshoeModelNumber%E2%80%9D:%E2%80%9D12308474%E2%80%9D,%E2%80%9DcartIndicator%E2%80%9D:false%7D,%22quantity%22:%7B%22value%E2%80%9D:%E2%80%9D253%E2%80%9D,%E2%80%9Dunits%E2%80%9D:%E2%80%9D1%E2%80%9D%7D,%E2%80%9Dinvoice%22:%7B%22invoiceNbr%E2%80%9D:%E2%80%9D12345678901%E2%80%9D,%E2%80%9DaisleNumber%E2%80%9D:%E2%80%9D1%E2%80%9D%7D%7D,%E2%80%9DshoeProfile%E2%80%9D:%7B%E2%80%9CrelativeId%E2%80%9D:%E2%80%9Daoej23094-h4h4h4-h4h4h-h3h45-123oje092384jd%E2%80%9D,%E2%80%9Dstyles%22:%5B%7B%22effectivePeriod%22:%7B%22start%22:%7B%22date%22:%7B%22year%22:2018,%22month%22:10,%22day%22:9%7D,%22time%22:%7B%22hour%22:14,%22minute%22:48,%22second%22:4,%22nano%22:687000000%7D%7D%7D,%22styleStatus%22:%22Registered%22,%22styleType%22:%7B%22codings%22:%5B%7B%22code%E2%80%9D:%E2%80%9D123456-7%E2%80%9D,%E2%80%9Ddisplay%E2%80%9D:%E2%80%9DShoe">http://abc-open.org/iso/3166/"}}],"electronicAddresses":[{"parentResourceId":"f133b31e0-1234-1234-1234-rt1204bf8122","address":"Kipchoge1@gmail.com"}],"phoneNumbers":[{"parentResourceId":"f133b31e0-1234-1234-1234-rt1204bf8122","countryCallingCode":"1","number”:”1232131234”,”extension":"","capabilities":{"fax":false,"voice":true,"text":false}}]},"practitioner":{"relativeId":"f133b31e0-1234-1234-1234-rt1204bf8122","externalId":"SHOEX:1","name":{"first”:”PATRICK”,”last”:”EVANS”},”clinicName":"SHOEX","phoneNumbers":[{"countryCallingCode":"1","number”:”1231231234”,”extension":"","capabilities":{"fax":false,"voice":true,"text":false}}]},"shopping":{"relativeId":"f133b31e0-1234-1234-1234-rt1204bf8122","shippingMethod":"STANDARD"},"prescription":{"relativeId":"f133b31e0-1234-1234-1234-rt1204bf8122","product”:{“aac”:”0987778769”,”consumerSku":"2976672”,”shoeModelNumber”:”12308474”,”cartIndicator”:false},"quantity":{"value”:”253”,”units”:”1”},”invoice":{"invoiceNbr”:”12345678901”,”aisleNumber”:”1”}},”shoeProfile”:{“relativeId”:”aoej23094-h4h4h4-h4h4h-h3h45-123oje092384jd”,”styles":[{"effectivePeriod":{"start":{"date":{"year":2018,"month":10,"day":9},"time":{"hour":14,"minute":48,"second":4,"nano":687000000}}},"styleStatus":"Registered","styleType":{"codings":[{"code”:”123456-7”,”display”:”Shoe</A> Weight","system":{"identifier":"<A href="http://shoe%E2%80%9D,%E2%80%9Dname%E2%80%9D:%E2%80%9DVAPORFLY">http://shoe”,”name”:”VAPORFLY</A> FLYKNIT”,”version":"V2”}}],”text":"Weight"},"value":{"quantity”:7.9,”uncertainty":0.0,"units":{"symbol":"lb","unitSystem”:”METRIC”}}}]},”createdDateTime":{"date":{"year":2018,"month”:10,”day”:1},”time":{"hour":14,"minute":48,"second":5,"nano”:124000000}},"updatedDateTime":{"date":{"year":2018,"month":10,"day":9},"time":{"hour":14,"minute":48,"second":11,"nano":377000000}},"status":"Processed",<STRONG>"processingStatus”:”BIDDING_STARTED”</STRONG>,”links":[{"rel":"self","href":"<A href="https://coding.io/v1/ShoppingCarts/a47b31e0-7443-48a9-8d98-ac3204bf824a%22,%22template%22:%7B%22variables%22:%7B%22variables%22:%5B%5D%7D,%22baseUri%22:%22https://coding.io/v1/ShoppingCarts/a47b31e0-7443-48a9-8d98-ac3204bf824a%22%7D%7D%5D%7D">https://coding.io/v1/ShoppingCarts/a47b31e0-7443-48a9-8d98-ac3204bf824a","template":{"variables":{"variables":[]},"baseUri":"https://coding.io/v1/ShoppingCarts/a47b31e0-7443-48a9-8d98-ac3204bf824a"}}]}</A>] </P> Mon, 15 Oct 2018 00:04:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434218#M167043 elheffe 2018-10-15T00:04:07Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434219#M167044 <P>Try this regex:</P> <PRE><CODE>|rex "processingStatus”:”(?&lt;processingStatus&gt;[^\”]+)" </CODE></PRE> Mon, 15 Oct 2018 17:46:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434219#M167044 493669 2018-10-15T17:46:27Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434220#M167045 <P>Rex seems to be ok but I'm <STRONG>not seeing any results parsed or when I add the stats count after</STRONG>?</P> <P><CODE>|rex "processingStatus”:”(?[^\”]+)" | stats count by processingStatus</CODE></P> Mon, 15 Oct 2018 18:19:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434220#M167045 elheffe 2018-10-15T18:19:13Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434221#M167046 <P>@elheffe, try exactly same command what I shown with <CODE>&lt;processingStatus&gt;</CODE> so that it will store extracted value in field name processingStatus then you can try stats command</P> <PRE><CODE>|rex "processingStatus”:”(?&lt;processingStatus&gt;[^\”]+)"| stats count by processingStatus </CODE></PRE> Tue, 16 Oct 2018 13:41:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434221#M167046 493669 2018-10-16T13:41:42Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434222#M167047 <P>@493669 <BR /> I think one of the issue is our Prod defaulting the view to "List" view instead of raw view. This is one of the reason that I might not getting the actual hit or stats based on the query we both have.</P> <P>Any idea on how I can indicate that I should be in "raw" result mode?</P> <P>Below is a sample list view as default mode coming up to our prod splunk - picture that value with processingStatus field.<BR /> <A href="https://answers.splunk.com/storage/temp/256156-json.jpg">https://answers.splunk.com/storage/temp/256156-json.jpg</A> <BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5954iE33DE8AA93687085/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 19 Oct 2018 17:16:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434222#M167047 elheffe 2018-10-19T17:16:49Z https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434223#M167048 <P>on above i am not able to find <CODE>processingStatus</CODE> field..<BR /> and secondly if you want statistics and not raw event then click on statistics tab or you can search your query in smart mode instead of verbose mode.</P> Fri, 19 Oct 2018 18:18:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-a-raw-msg-using-rex-then-get-the-stats-count-by/m-p/434223#M167048 493669 2018-10-19T18:18:07Z