topic Re: Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ? in Splunk Search

Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ?

DavisXie — Wed, 08 Oct 2014 23:59:02 GMT

Hello every one

host="abc"  user="12345678" | eval '"@@@" as action1| eval "###" as action2 | eval "$$$$" as actions2 | stats count by userID

There are 90 logline contains "@@@".

There are 90 logline contains "###".

There are 90 logline contains "$$$$".

All the "@@@" "### " "$$$$" are in the theRest field.

result
action1      90
action2     190
action3       3

Thank you all in advance.

Re: Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ?

MuS — Thu, 09 Oct 2014 05:49:53 GMT

Hi DavisXie,

not quiet sure what you want to do, but this is not the way eval works. If you want to use eval do something like this:

host="abc"  user="12345678" | eval action1=like(theRest, "created%") | eval action2=like(theRest, "submit%") | eval action3=like(theRest, "quit%") | stats count by user, action1, action2, action3

But usually if you want to get the actions from your events, you would get them into some field first and then do stuff with them. Try something like this:

host="abc"  user="12345678" | rex field=theRest "(?<action>(created)|(submit)|(quit))" | stats count by user, action

The rex field extraction can later be set as automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

hope this helps ...

cheers, MuS

Re: Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ?

DavisXie — Thu, 09 Oct 2014 05:59:44 GMT

After copying the "There are 90 logline contains "###", forgot to edit the numbers.

Question
host="abc" user="12345678" | eval '"created" as action1| eval "submit" as action2 | eval "quit" as actions2 | stats count by userID

There are 90 logline contains "created".
There are 190 logline contains "submit".
There are 3 logline contains "quit".

All the "created" "submit" "quit" are in the theRest field.

result
action1 90
action2 190
action3 3

Re: Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ?

MuS — Thu, 09 Oct 2014 06:14:02 GMT

update ping