How can I create report with following logs

[matthewoh]

Hi

I am trying to create report on following log

9/4/12
3:30:38.000 AM  
Sep  4 03:30:38 175.**.***.** Sep  3 16:44:55 penta-np syslogmd:  INTRUSION  DETECTION TIME : 12/9/3 16:44:55  RULE NAME : ParameterTampering  (client 203.**.**.** ) -> (server 175.**.**.**:80)
host=175.**.***.**   Options|  sourcetype=udp:514   Options|  source=udp:514   Options

This log is from Web Application Firewall and I want to
1. count by RULE NAME
2. count by client(in brackets)
3. count by server(in brackets)

I've been thinking of adding tags or fields but it is out of my ability.

Can some one help me ?

[lguinn2]

Try (typo corrected)

<yoursearchhere>
| rex "RULE NAME : (?<rule>.*?)  \(client (?<client>.*?)\s*\) -\> \(server (?<server>.*?)\s*\)"
| stats count by rule client server

This will create three temporary fields and use them to count. I think your search may be as simple as

sourcetype=udp:514

[lguinn2]

Sorry - I fixed the typo in the original answer,

[matthewoh]

Lisa,

I have tried
sourcetype="udp:514" | rex "RULE NAME : (?<rule>.*?) \(client (?<client>.*?)\s*\) -\> (\server (?<server>.*?)\s*\)"
| stats count by rule client server

and it returns me with following error.

[EventsViewer module] Error in 'rex' command: Encountered the following error while compiling the regex 'RULE NAME : (?<rule>.*?) \(client (?<client>.*?)\s*\) -\> (\server (?<server>.*?)\s*\)': Regex: missing )

[matthewoh]

Thank you Lisa. I will try this out.