Splunk Search

Get pattern count in a log line

lain179
Communicator

Hi,

I have log lines that looks like this

Fetching documents "FileName1.doc", "FileName2.xls", "FileName10.jpg", FileName342.docx" <ProcessID>

My goal is to find how many file names there are per ProcessID, given that each name is quoted and separated by a comma and a space. How can I accomplish that?

Thanks!

Tags (1)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

If the file names are bound by the phrase "Fetching Documents" and the "<ProcessID>", then capturing the names, converting to a list and then enumerating the items in that list will do.

At search time you can catch the data with a runtime extraction:

sourcetype="answers-1371175757" | rex field=_raw "Fetching\sdocuments\s(?<FileNames>.+?)\s+\<(?<ProcessID>.+?)\>" | table FileNames ProcessID

There are, of course, multiple ways of doing that efficiently and you can always improve on that method. This will render something like this:

alt text

Instead of a table use makemv to convert the field to a list -ensure you delimit the members of the list by a comma.

| makemv delim="," FileNames

At this point, enumerate using stats:

 | stats count(FileNames) AS count by ProcessID

All together, it should look something like this:

sourcetype="answers-1371175757" | rex field=_raw "Fetching\sdocuments\s(?<FileNames>.+?)\s+\<(?<ProcessID>.+?)\>" | makemv delim="," FileNames | stats count(FileNames) AS count by ProcessID

And, it should produce something like this:

alt text


gc

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...