Splunk Search

Count based on extracted field

athorat
Communicator

Hi

I have an event which has something like
/getproxy..... size:1
/getproxy..... size:10
/getproxy..... size:0

Want to calculate the total count when the size!=0 and count when size=0
using a rex in the search to extract size value

| rex "size:(?<Size>\d+)"

Any help appreciated

Tags (1)
0 Karma
1 Solution

fdi01
Motivator

try like :

 ...| rex "size:(?<Size>\d+)"|stats sum(eval(Size!=0)) as "total size!=0" sum(eval(Size=0)) as "total size=0"|...

or
for the number of time size!=0 and number of time size=0 try this:

 ...| rex "size:(?<Size>\d+)"|stats count(eval(Size!=0)) as "number of time size!=0" count(eval(Size=0)) as "number of time size=0"|...

View solution in original post

0 Karma

fdi01
Motivator

try like :

 ...| rex "size:(?<Size>\d+)"|stats sum(eval(Size!=0)) as "total size!=0" sum(eval(Size=0)) as "total size=0"|...

or
for the number of time size!=0 and number of time size=0 try this:

 ...| rex "size:(?<Size>\d+)"|stats count(eval(Size!=0)) as "number of time size!=0" count(eval(Size=0)) as "number of time size=0"|...
0 Karma

sideview
SplunkTrust
SplunkTrust

Of if you're more comfortable leaving eval tasks to the eval command, more or less the same idea would look like:
...| rex "size:(?\d+)"|eval type=if(Size=0,"zero","nonzero") | stats count by type

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...