topic Re: grouping by a log column in Splunk Search

grouping by a log column

toby53 — Fri, 28 Feb 2014 17:40:58 GMT

How can I do a group by on a log column.
For example:
for fore:
28.02.2014 18:08:30.841 ERROR [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]

I would like to group on [pool-6-thread-14-com/zz/zz/replication/job/webserver1(com/zz/zz/replication/job/webserver1)]with a count of occurrences. Like a group by in a relational database.
thanks

Re: grouping by a log column

MuS — Fri, 28 Feb 2014 18:08:58 GMT

Hi toby53,

First create a field extraction and use this field to group/stats on it. Assuming all your evnts for this new field starts with [ and ends with ] you can do something like this:

.... | rex "\s\[(?<myField>.*)\]" | stats count by myField

Hope this helps ...

Cheers, MuS

Re: grouping by a log column

toby53 — Fri, 28 Feb 2014 19:52:36 GMT

thanks - works great ! We get thousands of log messages.

Re: grouping by a log column

MuS — Fri, 28 Feb 2014 20:23:21 GMT

You're welcome, please accept the answer in this case thanks