topic Re: want to extract field values from log and perform stats on it. in Splunk Search

want to extract field values from log and perform stats on it.

nhatode — Wed, 15 Dec 2021 18:48:01 GMT

Hi,

Below is my Log:

"{"log":"{'URI': '/api/**/***/search?', 'METHOD': 'POST', 'FINISH_TIME': '2021-Dec-15 12:15:04 CST', 'PROTOCOL': 'http', 'RESPONSE_CODE': 202, 'RESPONSE_STATUS': '202 ACCEPTED', 'RESPONSE_TIME': 4.114464243873954} ","service_name":"Digdug/digdug","container":"Digdug-digdug-2","environment":"PROD"}"

Want to extract "RESPONSE_CODE" value

And show like below

RESPONSE_CODE	Count
202	1
200	6

Thanks

Re: want to extract field values from log and perform stats on it.

johnhuang — Wed, 15 Dec 2021 19:10:45 GMT

| rex "RESPONSE_CODE\'\:\s(?<RESPONSE_CODE>\d+)"
| stats count as Count by RESPONSE_CODE

edit: looks like @richgalloway beat me to it.

Re: want to extract field values from log and perform stats on it.

richgalloway — Wed, 15 Dec 2021 19:03:25 GMT

Here's one way.

<your search for Log> | rex "RESPONSE_CODE':\s*(?<RESPONSE_CODE>\d+)" | stats count by RESPONSE_CODE