Splunk Search
Highlighted

Chart count by specific colon separated field (syslog)

Explorer

Hi,

Im new to splunk and Im not a developer, and I got stuck trying to make a simple graphical display in dashboard showing syslog sources, using syslogs given hostnames. In example below (AP01-MATRIX).

If i use the "chart count by host" it gives me a graphic with 197.116.14.182 but I need to use AP01-MATRIX instead. I thought about using something simple like get the 4th item separated by colon, but I dont know how.


Feb 10 12:22:26 197.116.14.182 274: AP01-MATRIX: Mar 4 12:22:26.490 UTC: %DOT11-4-CCMP_REPLAY: Client baf6.85f8.1da6 had 1 AES-CCMP TSC replays

host = *
197.116.14.182** source = udp:514 sourcetype = syslog

Thanks in advance.

0 Karma
Highlighted

Re: Chart count by specific colon separated field (syslog)

Splunk Employee
Splunk Employee

This should work from the search bar but in the long term, you'll want to set the proper host metadata at the time of input.

... | rex "^(?:[^\s]+\s){5}(?<new_host>[^:]+)" | stats count by new_host

View solution in original post

Highlighted

Re: Chart count by specific colon separated field (syslog)

Explorer

Tried this:
sourcetype=syslog | ^(?:[^\s]+\s){5}(?[^:]+) | stats count by new_host

And got this:
Error in 'SearchParser': Missing a search command before '^'.

0 Karma
Highlighted

Re: Chart count by specific colon separated field (syslog)

Splunk Employee
Splunk Employee

Whoops, sorry about that. Updated the answer.

Highlighted

Re: Chart count by specific colon separated field (syslog)

Explorer

Thanks a lot! It worked exactly as I wanted! 🙂

0 Karma