Reporting

Summing multiple matches with rex command

jbrenner
Path Finder

I have a pattern of text that appears in a log statement multiple times.

Here is an example:

 

 

RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff

 

 

How can I use the rex command to get a sum of all the LoginCount values (which would total 12 in this example)?

Thanks!

Jonathan

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff
RandomStuff|LoginCount=6|RandomStuff|LoginCount=7|More RandomStuff|LoginCount=3|YetMoreRandomStuff"
| multikv noheader=t
| fields _*



| rex max_match=0 "LoginCount=(?<logincount>\d+)"
| streamstats count as row
| eventstats sum(logincount) as logincount by row
| fields - row

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff
RandomStuff|LoginCount=6|RandomStuff|LoginCount=7|More RandomStuff|LoginCount=3|YetMoreRandomStuff"
| multikv noheader=t
| fields _*



| rex max_match=0 "LoginCount=(?<logincount>\d+)"
| streamstats count as row
| eventstats sum(logincount) as logincount by row
| fields - row

jbrenner
Path Finder

Thank you! This is exactly what I needed!

0 Karma

jbrenner
Path Finder

I forgot to mention that I don't know how many times LoginCount will appear in any particular log statement. The number of instances will vary.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...