topic Re: Combine stats across multiline events in Splunk Search

Combine stats across multiline events

hulahoop — Wed, 05 Mar 2014 08:18:15 GMT

How can I get stats by author if I have multiline events like the below?

Project: /a/b/c
  loc=100 author=aaa@foo.com
  loc=100 author=bbb@foo.com
  loc=100 author=ccc@foo.com

Project: /a/b/c
  loc=200 author=aaa@foo.com
  loc=200 author=ccc@foo.com
  loc=200 author=ddd@foo.com

Given the 2 events above, am looking for a results table like this:

Project   Author         Total Lines of Code (loc)
-------------------------------------------------
/a/b/c    aaa@foo.com    300
          bbb@foo.com    100 
          ccc@foo.com    300
          ddd@foo.com    200

Re: Combine stats across multiline events

martin_mueller — Wed, 05 Mar 2014 08:33:42 GMT

You could do something like this:

... | rex "Project:\s+(?<project>\S+)" | rex max_match=0 "(?<loc_author>loc=\d+\s+author=\S+)" | mvexpand loc_author | rex field=loc_author "loc=(?<loc>\d+)\s+author=(?<author>\S+)" | stats sum(loc) by project author

Make sure that doesn't clash with a potentially auto-extracted first set of loc/author fields.

Re: Combine stats across multiline events

hulahoop — Wed, 05 Mar 2014 18:57:41 GMT

Thank you, Martin! mvexpand is magical. 🙂