https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70824#M17731 <P>Many thanks Iguinn!<BR /> Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!</P> Fri, 22 Mar 2013 12:25:30 GMT tsek13 2013-03-22T12:25:30Z https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70822#M17729 <P>Hi guys, i am newbie in Splunk and i have the following indexed line:</P> <P>Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO&nbsp; | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]</P> <P>How can I do this:<BR /> - get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw<BR /> - put the string <CODE>x.y|.z.k... in new field (a =</CODE>x.y|...)<BR /> - Remove duplicate values<BR /> - count all distinct strings<BR /> - generate chart or timechart or an hitmap with number of distinct strings</P> <P>Thanhs for all your suport</P> Fri, 22 Mar 2013 02:31:47 GMT https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70822#M17729 tsek13 2013-03-22T02:31:47Z https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70823#M17730 <P>Try this:</P> <PRE><CODE>yoursearchhere | rex "Event \'(?&lt;messageString&gt;.*?)\' is not allowed." | stats count by messageString </CODE></PRE> <P>or</P> <PRE><CODE>yoursearchhere | rex "Event \'(?&lt;messageString&gt;.*?)\' is not allowed." | timechart distinct_count(messageString) </CODE></PRE> <P>Replace "yoursearchhere" with whatever makes sense; that might mean something like <CODE>sourcetype=xyz</CODE><BR /> Did you need to restrict the search only to events that actually contain a messageString?</P> Fri, 22 Mar 2013 02:52:26 GMT https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70823#M17730 lguinn2 2013-03-22T02:52:26Z https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70824#M17731 <P>Many thanks Iguinn!<BR /> Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!</P> Fri, 22 Mar 2013 12:25:30 GMT https://community.splunk.com/t5/Splunk-Search/get-substring-from-long-raw-string/m-p/70824#M17731 tsek13 2013-03-22T12:25:30Z