topic Re: field extraction based onmore than one static strings and find out count in Splunk Search

field extraction based onmore than one static strings and find out count

jyothishtj — Wed, 23 Sep 2015 09:21:40 GMT

Hi,

I am new to Splunk. I am trying to create a splunk query to find out the count of occurrence for a specific set of messages in a log file.

E.g, there are 7 messages "message1" "Message2" "Message3".... Message7. I need to create a table in the below format.

Message Count

message1 2
Message2 0
message3 0
message4 1
.....
.....
message7 4

Also, I want to create a dropdown with the 7 message values. When I select a message I need to get the entry for that message. An all option in the dropdown to get all message counts.

Can we use regex for this purpose? or any other suggestions to achieve this. The messages will be appearing in different part of the event. I want to avoid repeated "messages" in the same event
Please help in this.

Thanks in advance,
Jyo

Re: field extraction based onmore than one static strings and find out count

benlc — Wed, 23 Sep 2015 11:02:10 GMT

Hi Jo

For the field definition regex would be suggested. You can test your regex with | rex field=_raw "yourregex" | count by messages.
If you name your field messages and then you get your table above. For help with your regex we would need an output of the log.

The dropdown will be the next step after prober setting the regex in the probs.conf as field extraction.

Bye
Ben

Re: field extraction based onmore than one static strings and find out count

badrinath_itrs — Wed, 23 Sep 2015 11:29:42 GMT

Hi,

You should use your query as ....(your search condition ) | stats count by (message field name) to get the count .

To create a drop down in your dashboard you should use the dynamic option to populate the drop down values and use a static for " all" options and select its value as "*". You can write your search as ....(your search condition ) | dedup (message field name) | field (message field name ) . You can take a look into the below documentation for more detail .

http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms

Use tokens in dashboard panel drop down and control your search using the token.

Hope it helps.

Thanks

Re: field extraction based onmore than one static strings and find out count

jyothishtj — Wed, 23 Sep 2015 11:32:44 GMT

The problem is the message is not part of any field. It is part of the event and can be present in any part of the event.

Re: field extraction based onmore than one static strings and find out count

badrinath_itrs — Wed, 23 Sep 2015 11:44:45 GMT

Does your event contains the same data . Also if possible can you paste your sample data here . Try to extract the required fields which will help here.

Re: field extraction based onmore than one static strings and find out count

woodcock — Wed, 23 Sep 2015 14:54:24 GMT

Like this:

... | rex max_match=0 "(?<message>(?:first message string)|(?:second message string)|(?:third message string)|(?:fourth message string)|(?:fifth message string)|(?:sixth message string)|(?:seventh message string))" | stats count by message

Tack on | fields - count to get just the list of messages.