topic Re: Rex/RegEx Question in Splunk Search

Rex/RegEx Question

tkwaller — Fri, 07 Feb 2014 19:33:21 GMT

Hello

I am trying to pull a text string out of some raw results using a simple regex. Heres my question: I would like to be able to get a stats count on the number of occurrances of this string. i would assume that you would have to put it into another field as it is simple text at the moment and not in a field. How would I do this? I am new to the rex/regex portion of Splunk and could use a little guidance.

Here is the raw data:

log_source=TT.WebService.Internal.OrderIntegration.OrderIntegration - Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange.
TT.Logic.TicketsNotFoundException: Exception of type 'TT.Logic.TicketsNotFoundException' was thrown.

I used \bUnable\b.* to get just the sentence "Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange."

I tried using "rex field=_raw...." and also creating a field named error like "rex field=error mode=sed" but am still not doing something correctly.

Any advice would be appreciated, thank you!

Re: Rex/RegEx Question

lukejadamec — Fri, 07 Feb 2014 20:12:10 GMT

Try this:

search |rex ".*(?P<UnableCart>unable.*)" |table UnableCart

Re: Rex/RegEx Question

martin_mueller — Fri, 07 Feb 2014 20:12:34 GMT

Are you trying to count the number of events that contain a certain string, or are you trying to count the number of times a certain string appears in one event?

Re: Rex/RegEx Question

tkwaller — Fri, 07 Feb 2014 20:48:23 GMT

I am trying to count the number of events that contain this string

Re: Rex/RegEx Question

martin_mueller — Fri, 07 Feb 2014 20:50:26 GMT

In order to count events containing a certain string, try something like this:

index=foo sourcetype=bar "a certain string" | stats count

Re: Rex/RegEx Question

tkwaller — Fri, 07 Feb 2014 20:53:07 GMT

Getting closer. I think I can move forward from here through trial and error. Thanks so much for the guidance