Archive

How to count the number of dots in a domain name

splunkranger
Path Finder

For exmaple:

www.host.com = 2
host.com = 1

Is there an easy eval command to count the number of occurrences of a particular character in a event?

Thank you,

Tags (1)
0 Karma

eashwar
Communicator

Hello Bro,

It was fun to find a solution to your question. I made the below query to check it out. Modify this to your requirement.

Run the below query in your splunk search

index=main | head 1 | eval custom_test="This . is . Eashwar . Raghunathan . and . i . am . playing . with . 10 . dots" | rex mode=sed field=custom_test "s/[^.]/X/g s/X//g" | eval NumberOfDots=len(custom_test) | table custom_test NumberOfDots

Hope in your case you will pass the string domain instead of custom_test

Happy splunking bro, thanks for asking tough questions 🙂

eashwar
Communicator

Hello AELLIOTT it is working now for me, I don't know why it did not work yesterday 😞 ... Confused

0 Karma

eashwar
Communicator

Hey i did it first, for some reason it did not work. It was unusual, so i was trying a couple of other ways to achieve the same

0 Karma

aelliott
Motivator

You could just have "s/[^.]//g" in your sed

aelliott
Motivator

someone else had this issue, and this worked for them:
http://answers.splunk.com/answers/28276/count-of-character-in-field

splunkranger
Path Finder

Perfect! thank you!

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!