Splunk Search

Count number of App IDs from log file

New Member

The appId length can vary at any given time..it can be 1 or X length

log files

Log1
appId=1231
appId=12355

Log2
appId=12
appId=53
appId=33

Log3
appId=132323

i have tried this but the out is exactly the same

rex "appId=\d(?\d+)" | stats count by appId

result
A . 0 . // i know there is A has a value 12
B . 4
C . 2

0 Karma

Esteemed Legend

Like this:

.... | rex max_match=0 "appId=\d(?<appId>\d+)" | stats count BY appId
0 Karma

SplunkTrust
SplunkTrust

appId being a key value pair should auto-extract I'm verbose mode.

Try this in verbose mode:

 ... | stats count by appId

The regex you have isn't matching your data either. Should be:

 ... | rex max_match=0 "appId=(?<appId>\d+)"

Not sure if the forum messed up your post or not. Max_match will make it match more than one per event though and it appears this is what you really need (applies if each of your logs is just one event in splunk).

0 Karma

New Member

Hi Thanks... i was not sure about max_match..not getting all the appIds.

I want to do something like this:

IndexList AppId Http URL Http Method . totalHit
index1 100 . employee/12 GET 10

index2 100 . url/employee POST 2
index3 200 . url put 30

Log files example
index=index1
2017-04-08, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST",
2017-04-03, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST",
2017-04-02, logger="test1, AppId="100",", httpPort="8443", accept="", contentType="application/json", requestURI="/employees", httpMethod="POST",

index=index2
2017-03-03, logger="test2", AppId="200",", , accept="", contentType="application/json", requestURI="/employee/1234", httpMethod="GET",

index=index3
2017-02-01, logger="test1, AppId="300",", httpPort="8443", accept="", contentType="application/json", contentLength="267", requestURI="/employee/create", httpMethod="PUT",

0 Karma

New Member

appId="132323"

appId="13"

appIds can come inside double "n"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!