topic How to cut data in field and display results as a count? in Splunk Search

How to cut data in field and display results as a count?

Yy4pb — Tue, 08 Mar 2022 04:47:27 GMT

Hello

I have a field called hostName which contains hosts:

host1\user1

host1\user2

host2\user2

host3\user3

And I want to basically do a count of the number of times each host appears:

so:

Host1 = 2

Host2 = 1

Host3 = 1

So I want to cut the data after the backslash (\) and display the host part of the data as a count.

I worked out the regex for this is ".+?\\" on Regex 101 but I am not able to figure it out with the rex field commands

Thank you!

Re: Cut data in field and display results as a count

gcusello — Mon, 07 Mar 2022 11:22:20 GMT

Hi @Yy4pb,

please try something like this:

| rex field=your_field "^(?<your_host>[^\\]+)"

Ciao.

Giuseppe

Re: Cut data in field and display results as a count

Yy4pb — Mon, 07 Mar 2022 17:51:46 GMT

EDIT: I had to add more backslashes to the Regex

| rex field=your_field "^(?<your_host>[^\\\\]+)"

Thanks!!

_________________

However when I run your command I get an error

Error in 'rex' command: Encountered the following error while compiling the regex '^(?<your_host>[^\]+)': Regex: missing terminating ] for character class.

Re: Cut data in field and display results as a count

gcusello — Tue, 08 Mar 2022 08:05:49 GMT

Hiu @Yy4pb,

you used too many backslashes, the last of tem is considered by Splunk as an escape of ], so the condition in the regex isn't closed.

Try using [^\\] or [^\\\].

Ciao.

Giuseppe