Search in single table with multiple stats

mawani — Mon, 15 Nov 2021 21:21:59 GMT

Hello,

I am having logs in splunk in below manner.

timestamp "LOGGER= PAGE NAME1 Other text"
timestamp "LOGGER= PAGE NAME1 Other text"
timestamp "LOGGER= PAGE NAME2 Other text"
timestamp "LOGGER= PAGE NAME2 Other text"
timestamp "LOGGER= PAGE NAME3 Other text"
timestamp "LOGGER= PAGE NAME3 Other text"
timestamp "LOGGER= PAGE NAME1 Other text"

I formatted search query
index=index-name ns="namespace" | rex field=_raw "LOGGER=\s*(?<PAGE_NAME1>PAGE NAME1*)" | stats count by PAGE_NAME1
| append [search
index=index-name ns="namespace" | rex field=_raw "LOGGER=\s*(?<PAGE_NAME2>PAGE NAME2*)" | stats count by PAGE_NAME2 ]
| append [search
index=index-name ns="namespace" | rex field=_raw "LOGGER=\s*(?<PAGE_NAME3>PAGE NAME3*)" | stats count by PAGE_NAME3 ]

Got result like

PAGE_NAME1	Count	PAGE_NAME2	PAGE_NAME3
PAGE NAME1	3
	2	PAGE NAME2
	2		PAGE NAME3

I am looking result should look below

Page Name	Pages Visited
PAGE_NAME1	3
PAGE_NAME3	2
PAGE_NAME3	2

Any idea how to format search query ?

Re: Search in single table with multiple stats

somesoni2 — Mon, 15 Nov 2021 21:36:07 GMT

Try like this

index=index-name ns="namespace" | rex field=_raw "LOGGER=\s*(?<PAGE_NAME>(PAGE NAME1|PAGE NAME2|PAGE NAME3)*)" | stats count by PAGE_NAME1

Re: Search in single table with multiple stats

mawani — Tue, 16 Nov 2021 00:30:29 GMT

Thank You for very quick response and it is working

topic Re: Search in single table with multiple stats in Splunk Search

Search in single table with multiple stats

Re: Search in single table with multiple stats

Re: Search in single table with multiple stats