topic Re: how to return count of certain text using splunk regular expression in Splunk Search

How to return count of certain text using Splunk regular expression?

ABHAYA — Tue, 30 May 2023 03:51:20 GMT

I have an input string which contains strings like code =test1 description=test1 description status = pending,code =test2 description=test2 description status = COMPLTED, code =test3 description=test3 description status = COMPLETED_FIRST,code =test2 description=test2 description status = COMPLTED,

Expected Ouput

Code count

test2 2

test3 1

Basically i am looking for whose status is completed or starts with completed word those code name and completion count in the result. Can anyone please help me on this.

Re: how to return count of certain text using splunk regular expression

gcusello — Mon, 29 May 2023 12:54:40 GMT

Hi @ABHAYA.,

if you want to know only the codes where the status is "COMPLETED", you could run:

index=your_index status=COMPLETED | stats count BY Code

if you want also add all the information about status, you could run:

index=your_index | stats count BY Code status

Ciao.

Giuseppe

Re: how to return count of certain text using splunk regular expression

ABHAYA — Mon, 29 May 2023 13:19:35 GMT

code =test1 description=test1 description status = pending,code =test2 description=test2 description status = COMPLTED, code =test3 description=test3 description status = COMPLETED_FIRST,code =test2 description=test2 description status = COMPLTE. This input is a single string. I do not have data in table format.I tried with the solution provided by you .it is not working

Re: how to return count of certain text using splunk regular expression

gcusello — Mon, 29 May 2023 13:35:55 GMT

Hi @ABHAYA,

if you have all the fields in the same event, you have to divide it using something like this:

| makeresults | eval _raw="code =test1 description=test1 description status = pending,code =test2 description=test2 description status = COMPLTED, code =test3 description=test3 description status = COMPLETED_FIRST,code =test2 description=test2 description status = COMPLTE." | rex max_match=0 "(?<event>[^,\.]+)" | mvexpand event | rex field=event "code\s*\=\s*(?<code>\w*)" | rex field=event "status\s*\=\s*(?<status>\w*)" | stats count BY code status

when you arrive at the last raw, you can aggregate as you like.

Ciao.

Giuseppe

Re: how to return count of certain text using splunk regular expression

ITWhisperer — Mon, 29 May 2023 13:41:04 GMT

| rex max_match=0 "code\s*=\s*(?<code>\S+)" | stats count by code

Re: how to return count of certain text using splunk regular expression

yuanliu — Tue, 30 May 2023 07:31:19 GMT

Luckily each test segment is delimited by comma. You can use that to break the raw input into individual events, like this:

| eval data = split(_raw, ",") | mvexpand data | rename data AS _raw | extract

Ultimately, though, your developer should consider breaking the events in raw logs.

Below is data emulation you can play with and compare with your real data.