topic Simple syntax to filter data by _raw value in Splunk Search

Simple syntax to filter data by _raw value

razlani — Wed, 11 Mar 2015 19:14:24 GMT

Hi all - I'm new here (literally an hour old) so go easy.

I've read through parts of the docs and am currently using:

host=crm index=main tag=error | eval kek = regex_raw = "foo@bar.com" | stats count by kek

On data like:

2015-01-16 13:00:19,747 [foo@bar.com] ERROR jelly.fish.cake......

To try and play with data filtered by counting errors from particular usernames in the raw data like so.

I'm almost there but get an error message about using eval on boolean data (the docs of which I've read); but which I've still yet to nail the syntax for.

I've tried using rex, an if statement with eval (as suggested), tostring() (as suggested) and phrasing it differently like piping the data into the eval... but that simply pipes all of the data rather than the usernames I'm interested in - and it seems like I just can't get the syntax right.

Could you please tell me how I could filter data by the email address and count them like I'm trying?

Thanks so much!!

raz

Re: Simple syntax to filter data by _raw value

somesoni2 — Wed, 11 Mar 2015 19:53:54 GMT

Try this

Get count by email address

host=crm index=main tag=error |  rex "\[(?<kek>.[^\]]+)\]" | stats count by kek

Re: Simple syntax to filter data by _raw value

richgalloway — Wed, 11 Mar 2015 20:04:19 GMT

Assuming you want to filter a single email address, your example could written something like this:

host=crm index=main tag=error "foo@bar.com" | stats count(_time)

This pulls all events from the main index where the host field has the value "crm", are tagged as "error", and contain "foo@bar.com" somewhere in them. It then counts the events found.

Something more generic might be:

host=crm index=main tag=error | rex "\[(?P<addr>[^\]]+)\]" | stats count(_time) by addr

Again, we're looking at all events from the main index where the host field has the value "crm" and are tagged as "error". The rex command extracts anything between square brackets from the _raw field (by default) and puts it into a field called "addr". We then count each addr found.

Re: Simple syntax to filter data by _raw value

razlani — Wed, 11 Mar 2015 22:34:11 GMT

would make both answers correct if I could

Re: Simple syntax to filter data by _raw value

razlani — Wed, 11 Mar 2015 22:34:19 GMT

Thank you both!