Splunk Search

Chart of multiple field values in one line

hofer
Explorer

I'd like to make a chart on how many times a state-text occurs. The thing is, there can be more than one state-text in one log line. At least there is one state-text ("state-text0":"xyz"), but it's possible to have up to 10 state-texts ("state-text9":"xyz") occuring in that field of a csv I extract before with regex ("TPIOUT").
Two sample lines:

...|{...","id":"13543","recipient0":"41790094703","state0":"0","state-text0":"Ok","recipient1":"41790034932","state1":"0","state-text1":"Ok","recipient2":"41790028491","state2":"4","state-text2":"invalid short id","recipient3":"41790045754","state3":"0","state-text3":"Ok"}|...

...|{...","id":"13544","recipient0":"417924524503","state0":"4","state-text0":"Error due sys fail","recipient1":"41792534932","state1":"0","state-text1":"Ok","recipient2":"41135135491","state2":"0","state-text2":"Ok"}|...

So I want to see a chart like this:
OK: 5
invalid short id: 1
Error due sys fail: 1

"state-text[0-9]" is independent of "state[0-9]"

I tried something like this, but it didn't return a chart with values:
... | regex _raw="(?i)^(?:[^|]|){50}(?P[^|])" | rex max_match=10 state-text\d":"(?\w+) | eval state_text='states' | chart count by state_text

Thanks in advance for your help!

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Your chart command didn't chart any values because it only contained a single non-numeric value ("states"). I'm not sure what the regex command is supposed to do. The rex command looks OK, but needs to extract fields to be charted. Try this:

... | rex max_match=10 "state-text\d\":\"(?P<state_text>[]\w ]+)" | chart count by state_text
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Your chart command didn't chart any values because it only contained a single non-numeric value ("states"). I'm not sure what the regex command is supposed to do. The rex command looks OK, but needs to extract fields to be charted. Try this:

... | rex max_match=10 "state-text\d\":\"(?P<state_text>[]\w ]+)" | chart count by state_text
---
If this reply helps you, Karma would be appreciated.

hofer
Explorer

Thank you very much for your help! I could make it work like that. With your explanation I also understand the way of how the rex works in this command.
The regex before gave only the content of that field to the next pipe

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...