topic Re: Sub Search counts in Splunk Search

Sub Search counts

SUNRAJ — Tue, 12 Oct 2021 16:38:11 GMT

I have filed called serial_id which have value ABC2022100845001

I need count with contain 45 in last 5 & 6 th bytes

somesoni2 — Tue, 12 Oct 2021 18:25:52 GMT

Try this:

Your base search | regex serial_id=".+45...$" | stats count

SUNRAJ — Tue, 12 Oct 2021 22:21:09 GMT

yes it works- if i need another value in sub search and counts in table with distinct counts ??

ITWhisperer — Wed, 13 Oct 2021 08:10:43 GMT

base search | rex field=serial_id ".+(?<marker>..)...$" | stats count by marker

SUNRAJ — Wed, 13 Oct 2021 15:04:04 GMT

yes it works- if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?