Interactive Field Extraction

[Splunk_User792]

2012-06-21 23:58:57,200 [M3P3] DEBUG - LOG|2012-06-21|23:58:57|4|9|AB123C|MCL|88|1234|123456|12345|N|N|AAAA 1234567||||||||||AAAA 1234567|AAAA 1234567||5|||||||||YES|A|AA$BBB|Y|123|

I want to extract field like Auto = with values YES and NO
When I extract field from left of the timestamp of the results of the search, I get the result as below
FIELD NAME ---- COUNT
YES --------------- 2054
NO ---------------- 21

But my total result is 2320 and count of YES should be 2054 (which is correct) and count of NO should be 266 according to the count result done by searching manually from search bar.
Why do I get incorrect count of NO?
I want to create pie chart of YES and NO counts. For that, I think I must have this information correct right?
Please Help me..
Thank you very much..

[rturk · Accepted solution]

You may have other instances of "YES" or "NO" in other fields which could be skewing your results. The key here is making sure your field extractions are correct.

You have a pipe-delimited filed, with the 36th field being the value you're interested in. Not sure whether you're interested in the other fields, but here goes.

props.conf

[yoursourcetype]
pulldown_type = false
KV_MODE = false
SHOULD_LINEMERGE = false
REPORT-fields = yoursourcetype_fields

transforms.conf

[yoursourcetype_fields]
DELIMS = "|"
FIELDS = "header", "date", "time", "field_4", ... , "field_35", "yes_no"

Splunk Search

sourcetype=yoursourcetype | stats count by yes_no

There is no doubt a more elegant way of doing this by regular expressions, my regex-fu is weak 😛

Hope this helps!

[Splunk_User792]

WOW, THANK YOU SO MUCH!!!! V^-^V