Splunk Search

How to count the number of dots in a domain name

splunkranger
Path Finder

For exmaple:

www.host.com = 2
host.com = 1

Is there an easy eval command to count the number of occurrences of a particular character in a event?

Thank you,

Tags (1)
0 Karma

eashwar
Communicator

Hello Bro,

It was fun to find a solution to your question. I made the below query to check it out. Modify this to your requirement.

Run the below query in your splunk search

index=main | head 1 | eval custom_test="This . is . Eashwar . Raghunathan . and . i . am . playing . with . 10 . dots" | rex mode=sed field=custom_test "s/[^.]/X/g s/X//g" | eval NumberOfDots=len(custom_test) | table custom_test NumberOfDots

Hope in your case you will pass the string domain instead of custom_test

Happy splunking bro, thanks for asking tough questions 🙂

eashwar
Communicator

Hello AELLIOTT it is working now for me, I don't know why it did not work yesterday 😞 ... Confused

0 Karma

eashwar
Communicator

Hey i did it first, for some reason it did not work. It was unusual, so i was trying a couple of other ways to achieve the same

0 Karma

aelliott
Motivator

You could just have "s/[^.]//g" in your sed

aelliott
Motivator

someone else had this issue, and this worked for them:
http://answers.splunk.com/answers/28276/count-of-character-in-field

splunkranger
Path Finder

Perfect! thank you!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...