Getting Data In

How to search with regex and status count to show in a table?

Wendy
Explorer

Hi, need some help in crafting a search query that could get count by a regex and display counts in a table.

 

The log msg we have is "Successfully submitted: admin-mobile" or "Successfully submitted: admin". I'd like to count numbers of msg contains "admin-mobile" and "admin" respectively and show them in a table.

 

I know that I can get one count by:

`| search "Successfully submitted: admin-mobile" | stats count` and it will show in a table. 

Question is how to get the other count. Thanks.

 

The result i'd like to have is like below, in a table format:

submissionType        count   

admin-mobile              999

admin                              888

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use

your_search... "Successfully submitted: admin*" 
| rex "Successfully submitted: (?<user>[\w-]+)"
| stats count by user

your rex regex will be dependent on what you want to extract and what may follow user name, but the above will take user from the words following the Successfully submitted message.

0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...