charting raw data

[jossaq]

I have a raw entries like this:

[08/14/12 09:58:55] SNMP INFO request  received from 10.25.6.227  with unknown community string cable-d

the word after "string" varies form log to log.

I want to search something like this

... | chart count(word_after_"string") by host,word_after_string

How can I do that?

Reggards

[tfletcher_splun]

You need to do a field extraction. Best choice is probably the rex command, though if you do this frequently you probably want to make it an automatic extraction in props.conf

... | rex field=_raw "string\w+(?<word_after_string>.*)$" | chart count by host, word_after_string

That should get you started, more details at:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

[Ayn]

... | rex "unknown community string (?<community_string>\S+)" | chart count by host,community_string