Chart count by specific colon separated field (syslog)

[onbits]

Hi,

Im new to splunk and Im not a developer, and I got stuck trying to make a simple graphical display in dashboard showing syslog sources, using syslogs given hostnames. In example below (AP01-MATRIX).

If i use the "chart count by host" it gives me a graphic with 197.116.14.182 but I need to use AP01-MATRIX instead. I thought about using something simple like get the 4th item separated by colon, but I dont know how.


Feb 10 12:22:26 197.116.14.182 274: AP01-MATRIX: Mar 4 12:22:26.490 UTC: %DOT11-4-CCMP_REPLAY: Client baf6.85f8.1da6 had 1 AES-CCMP TSC replays

host = **197.116.14.182* source = udp:514 sourcetype = syslog

Thanks in advance.

[sbrant_splunk · Accepted solution]

This should work from the search bar but in the long term, you'll want to set the proper host metadata at the time of input.

... | rex "^(?:[^\s]+\s){5}(?<new_host>[^:]+)" | stats count by new_host

[onbits]

Thanks a lot! It worked exactly as I wanted! 🙂

[sbrant_splunk]

Whoops, sorry about that. Updated the answer.

[onbits]

Tried this:
sourcetype=syslog | ^(?:[^\s]+\s){5}(?[^:]+) | stats count by new_host

And got this:
Error in 'SearchParser': Missing a search command before '^'.