parsing log text to get a specific info

[wxt4359]

Hi I am newbie to splunk and trying to build a search query that can parse a specific text like below to get the sum of the AAA file content length but couldn't figure out on the search query for that. Any helps will be appreciated. Thanks.

AAA file content length is 67095 bytes
AAA file content length is 7095 bytes

[gcusello · Accepted solution]

Hi @wxt4359,
as @martin_mueller hinted, you have to extract the filename and length fields using a rex and the sum the values of the length field for each filename using stats, something like this:

index=your_index
| rex "^(?<filename>[^ ]+).*length\s+is\s+(?<legth>\d+)\sbytes"
| stats sum(length) AS total_length BY filename

You can test your regex at https://regex101.com/r/no5Gwk/1
You can find more details baour rex and stats command at the urls indicated by martin_mueller.

Ciao.
Giuseppe

[martin_mueller]

Use rex to extract the number of bytes: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/rex
Use stats to sum up that number: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/stats

[to4kawa]

....
| rex "(?<content_length>\d+)"
| stats sum(content_length) as total_bytes

[wxt4359]

Thank you all