topic Re: Help on a REX extract - and count in Splunk Search

Help on a REX extract - and count

LizAndy123 — Mon, 27 Jan 2025 20:02:29 GMT

So I have an Index

Index= xxxxxx "Stopping iteration"

I have the rex for getting the unique Id

Event Sample : Stopping iteration - 1900000000: 2000 Files accepted

so my current REX is rex "Stopping\siteration[\s\-]+(?<stop_reg_id>[^:\s]+)" and it extracts the 1900000000

I want to extract the 2000 number and then do a count for 24 hours.

Any help would be great

LizAndy123 — Mon, 27 Jan 2025 20:08:55 GMT

So basically I need the total number of files I uploaded in a 24 hour period once I get that figure extracted

richgalloway — Mon, 27 Jan 2025 20:10:52 GMT

It would help to know what you've tried so far, but getting the other field is just a matter of extending the regex.

"Stopping\siteration[\s\-]+(?<stop_reg_id>[^:\s]+):\s*(?<file_count>\d+)"

LizAndy123 — Mon, 27 Jan 2025 20:24:51 GMT

Thanks

This helps extracting the number - how do I do the sum at the end ?

in 24 hours I could have 96 * 2000 file uploads

richgalloway — Mon, 27 Jan 2025 20:37:55 GMT

One way is with addcoltotals

| rex "..." ``` more query stuff``` | addcoltotals file_count

LizAndy123 — Mon, 27 Jan 2025 20:41:17 GMT

Hey Rich that works and I get the total at the bottom but it shows every single column also.

Example I had 98 Events and total was 157,000 but it shows every single event and the columns

richgalloway — Mon, 27 Jan 2025 21:58:41 GMT

If all you want is a single integer that is the total of all file_count values then stats is the way to go.

| rex "..." ``` more query stuff ``` | stats sum(file_count) as Total_Count