topic extract field value in Splunk Search

extract field value

iamniks — Mon, 28 Sep 2020 10:07:13 GMT

Hi, we have csv file in below format.

PROJECT_NAME USER_NAME STATUS

WEB_xxxx David PASSED
WEB_xxxx Rapkin FAILED
WEB_xxxx Rapkin PASSED
WEB_xxxx Diana PASSED
DC_xxxx John FAILED
PROMOTE_xxxx Paul PASSED
AST_xxxx John PASSED

Would like to generate report as below. Basically we would like to group projects based on their prefix and have a count for each group.

PROJECT: COUNT PASSED FAILED
WEB 4 3 1
DC 1 0 1
PROMOTE 1 1 0
AST 1 1 0

Re: extract field value

Ayn — Thu, 17 Nov 2011 10:39:55 GMT

How is this different from this question? http://splunk-base.splunk.com/answers/34471/field-value-count

Re: extract field value

woodcock — Sat, 30 May 2015 03:45:06 GMT

Try this:

... | rex "^(?<PROJECT>[^_]*)_[\S]*\s+(?<USER>[\S]*)\s+(?<STATUS>[\S]*) | stats count AS COUNT count(eval(STATUS="PASSED)) AS PASSED BY PROJECT | eval FAILED = COUNT - PASSED