Splunk Search

After extracting a field with rex, what is the most efficient way to call stats on a specific value within this field?

Engager

Hi, any help with this would be appreciated!

 

rex field=msg.message "loc=(?<place>\d+)" | search place="16" | stats count by "place"  

The extracted field is place. The specific place I am searching for is "16". Is there a more efficient way to search for a specific place before calling stats? 

Labels (2)
0 Karma

SplunkTrust
SplunkTrust
Looks fine to me.
---
If this reply helps you, an upvote would be appreciated.

Engager

@richgalloway Is there any more efficient way to do this such as bypassing the field extraction if I am only looking for a singular specific "place"?

0 Karma

SplunkTrust
SplunkTrust

I'm not sure if it's "more efficient", but you could try this search.  Compare this your other one using Job Inspector to see which works best.

| where match(msg.message, "loc=16")| stats count
---
If this reply helps you, an upvote would be appreciated.
0 Karma