topic Re: How can I group multiple values from repeated fields in the same log? in Splunk Search

How can I group multiple values from repeated fields in the same log?

grevortex — Mon, 06 Dec 2021 17:21:57 GMT

Hi all,

I would like to know if there is a way to group multiple values from repeated fields that are coming in the same log, for example, taking into account the following log event containing the following data:

Log1: moduleName="Module A" moduleType="TypeA" moduleName="Module B" moduleType="TypeB"

Log2: moduleName="Module C" moduleType="TypeC" moduleName="Module A" moduleType="TypeA"

I tried something like:

app_search_criteria | stats count by moduleName | sort -count

But this way it's only bringing data for the first moduleName field it finds in one log and not for all of them, for example, I'm getting the following table:

moduleName count

ModuleA 1

ModuleC 1

The ideal approach would be:

moduleName moduleType count

ModuleA TypeA 2

ModuleB TypeB 1

ModuleC TypeC 1

Thanks in advance!

Re: How can I group multiple values from repeated fields in the same log?

ITWhisperer — Mon, 06 Dec 2021 17:37:25 GMT

app_search_criteria | rex max_match=0 "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")" | mvexpand nametype | rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\"" | stats count by moduleName moduleType | sort -count

Re: How can I group multiple values from repeated fields in the same log?

grevortex — Mon, 06 Dec 2021 18:39:59 GMT

Hi @ITWhisperer , thanks very much that did the trick!