Multiple occurrences of fields

lain179 — Fri, 28 Feb 2014 03:07:46 GMT

Hello,

I have log lines that look like this [ some silly example but the idea is there 🙂 ]

mm/dd/yyyy hh:mm:ss - fruit: apple count: 5 price: $4 fruit: orange count: 10 price: $10

mm/dd/yyyy hh:mm:ss - fruit: banana count: 2 price: $1 fruit: orange count: 10 price: $10 fruit: pear count: 8 price: $14

mm/dd/yyyy hh:mm:ss - fruit: pineapple count: 10 price: $40 fruit: mango count: 1 price: $1

mm/dd/yyyy hh:mm:ss - fruit: coconut count: 5 price: $8 fruit: apple count: 5 price: $1

I know how to use rex to grab the fruit, count and price values from each line. There will be variable number of pairs of those values. How do I display the information for apple only using stats or anything by date?

In my example, only first and last log lines have apple in them. I want to display the count and price of apple for those two dates.

Appreciate any help.

Re: Multiple occurrences of fields

somesoni2 — Fri, 28 Feb 2014 05:15:10 GMT

As you said you're able to get the fruit, count and price for each line and since they repeat within same event as well, they are multivalued field. try this.

your base search + rex, giving _time, fruit(mvfield), count,price | eval fruitline=mvzip(fruit,count) | eval fruitline=mvzip(fruitline,price) | table _time, fruitline | mvexpand fruitline | rex field=fruitline "(?<fruit>.*),(?<count>.*),(?<price>.*)"| table _time fruit count price | where fruit="apple"

topic Re: Multiple occurrences of fields in Splunk Search

Multiple occurrences of fields

Re: Multiple occurrences of fields