topic Extract string and separate results by different strings in Splunk Search

Extract string and separate results by different strings

EricLloyd79 — Tue, 15 Apr 2014 15:04:10 GMT

I have been looking for days for an answer to this on Splunk answers and elsewhere.

I have a query like this:
sourcetype="*-xxx01" (XXX0014 OR XXX0019 OR XXX0018 OR XXX0015) | timechart span=30m COUNT

XXX014, XXX019, XXX018, XXX015 are all strings in each log entry (they are KPIs) (its either XXX014 or XXX019 or XXX018 or XXX015 obviously in each log entry). I am trying to get results returned that are in columns so I can separate the results based on these KPIs. This would be so easy if they were part of a field. I could use "by fieldname" but these aren't part of a field. I was hoping I could do "COUNT by sum(XXX0014) sum(XXX019) sum(XXX018) sum(XXX015)" but that doesn't work. Below is an example of a log entry. Any help would be greatly appreciated!! (ultimate goal is a timechart bar graph that separates by different string values in each span)

2014-04-15 15:00:48,056 [INFO] [UUID=XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX subNo=XXXXXXXXXXX yhn=000000000] XXX0014: Ignored notification grant. cause=IgnoreNotificationException Ignore Grant Notification

Where it says XXX0014... that is the value I want to separate my results with.

Re: Extract string and separate results by different strings

martin_mueller — Tue, 15 Apr 2014 15:47:03 GMT

The easiest would be to get them extracted into a field, say KPI, and do a timechart count by KPI. For your sample event, you should be able to temporarily extract the field like this:

base search | rex "\]\s+(?<KPI>\w+):" | timechart count by KPI

If that works, move the extraction to the config (Settings -> Fields -> Field Extractions) so you can drop the rex call from the search. If your other KPIs are in differently looking events you can define multiple extractions that all yield the same field name.

Re: Extract string and separate results by different strings

EricLloyd79 — Tue, 15 Apr 2014 16:19:56 GMT

This worked beautifully... thank you!