topic How to search and sort based on dynamic value? in Splunk Search

How to search and sort based on dynamic value?

batham — Tue, 13 Dec 2022 02:44:50 GMT

Hi,

I am new to splunk and have a requirement where i have to search the logs which are on 100 servers and i have to figure if each log may consist 2 statements as below ex:

"started step1"

"started step2"

source of log contains actual name of source where i can check the step (location of log /test/test1/ABC.log ,/test/test1/CDE.log,/test/test1/DEF.log) which i figured out based on rex command (using regex)

I want a table which contain for each log how many step are completed. like:

ABC started step1 started step2

CDE started step1

DEF started step1 started step2

Re: Search and sort based on dynamic value

richgalloway — Mon, 12 Dec 2022 21:02:19 GMT

Perhaps this will help

index=foo ("started step1" OR "started step2") ```Extract the step into a field``` | rex "(?<step>started step\d)" ```Group the steps by reporting host``` | stats values(step) as steps by host

Re: Search and sort based on dynamic value

batham — Mon, 12 Dec 2022 21:10:59 GMT

Thanks, though while searching in community i find the answer https://community.splunk.com/t5/Splunk-Search/Combine-multiple-rows-in-one-with-a-common-key/td-p/422336

Re: Search and sort based on dynamic value

richgalloway — Tue, 13 Dec 2022 13:11:01 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.