topic Re: Need a query to find count of substring within string in Splunk Search

Need a query to find count of substring within string

caschmid — Tue, 10 Jun 2025 17:03:02 GMT

I need a query that will tell me the count of a substring within a string like this ...

"This is my [string]" and I need find the word and count of [string]. "This is my" is always the same but [string] is dynamic and can be many things, such as apple, banana etc. I need tabular data returned to look like

Word Count

apple 3

I tried this but doesnt seem to working

rex field=_raw ".*This is my (?<string>\d+).*" | stats count by string

Re: Need a query to find count of substring within string

PickleRick — Tue, 10 Jun 2025 18:16:54 GMT

Use https://regex101.com to verify your regexes.

In this case it won't work for "string" not being a number because \d+ means a sequence of digits. Depending on how precise you want to be with this match, you might want \S+ or some other variation.

Re: Need a query to find count of substring within string

livehybrid — Tue, 10 Jun 2025 20:17:22 GMT

Hi @caschmid

Would something like this work for you? This assumes you know the string you want count, is that right?

| rex max_match=100 field=_raw "(?<extract>\[string\])" | stats count by extract

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Need a query to find count of substring within string

bowesmana — Tue, 10 Jun 2025 22:35:42 GMT

In addition to the other comments, you don't need the .* at the start and end of the regex

Re: Need a query to find count of substring within string

yuanliu — Tue, 10 Jun 2025 22:36:19 GMT

Two problems with your regex.

\d represents a digit 0-9. Unless your "string" only includes digits, \d+ will not match.
As @livehybrid notes, your original string includes a pair of square brackets.

A usable code to extract "apple" from "This is my [apple]" would be

| rex "This is my \[(?<string>[^\]]+)\]" | stats count by string

Note:

_raw is the default field for rex command.
.* at beginning and end of a regex serves no purpose except adding cost.

Re: Need a query to find count of substring within string

PrewinThomas — Wed, 11 Jun 2025 03:50:37 GMT

@caschmid

\d+ matches only digits, not any word.

If "This is my" is always constant, you can try below
rex field=_raw "This is my (?<string>\w+)" | stats count by string

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a kudos/Karma. Thanks!