topic Re: Chart count by specific colon separated field (syslog) in Splunk Search

Chart count by specific colon separated field (syslog)

onbits — Mon, 28 Sep 2020 15:50:42 GMT

Hi,

Im new to splunk and Im not a developer, and I got stuck trying to make a simple graphical display in dashboard showing syslog sources, using syslogs given hostnames. In example below (AP01-MATRIX).

If i use the "chart count by host" it gives me a graphic with 197.116.14.182 but I need to use AP01-MATRIX instead. I thought about using something simple like get the 4th item separated by colon, but I dont know how.

Feb 10 12:22:26 197.116.14.182 274: AP01-MATRIX: Mar 4 12:22:26.490 UTC: %DOT11-4-CCMP_REPLAY: Client baf6.85f8.1da6 had 1 AES-CCMP TSC replays

host = **197.116.14.182* source = udp:514 sourcetype = syslog

Thanks in advance.

Re: Chart count by specific colon separated field (syslog)

sbrant_splunk — Mon, 10 Feb 2014 15:58:47 GMT

This should work from the search bar but in the long term, you'll want to set the proper host metadata at the time of input.

... | rex "^(?:[^\s]+\s){5}(?<new_host>[^:]+)" | stats count by new_host

Re: Chart count by specific colon separated field (syslog)

onbits — Mon, 10 Feb 2014 16:06:13 GMT

Tried this:
sourcetype=syslog | ^(?:[^\s]+\s){5}(?[^:]+) | stats count by new_host

And got this:
Error in 'SearchParser': Missing a search command before '^'.

Re: Chart count by specific colon separated field (syslog)

sbrant_splunk — Mon, 10 Feb 2014 16:08:48 GMT

Whoops, sorry about that. Updated the answer.

Re: Chart count by specific colon separated field (syslog)

onbits — Mon, 10 Feb 2014 16:33:18 GMT

Thanks a lot! It worked exactly as I wanted! 🙂