Splunk Search

Events contain several occurrences of search string

smiehe
New Member

I'd like to count the occurrences of a certain string for a specific server. Right now I'm using:

host="host.test.com" AND "Sent mail to" | stats count as Total

This returns the number of Events found. However, in some cases one event contains this string more than once and I'd like to count those as well.

How do I count the occurrences of that String rather than the number of events this String occurs in?

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

host="host.test.com" AND "Sent mail to" | rex field=_raw max_match=0 "(?P<SentMail>Sent mail to*)" | eval count=mvcount(SentMail) | stats sum(count) as Total

View solution in original post

somesoni2
Revered Legend

Try this

host="host.test.com" AND "Sent mail to" | rex field=_raw max_match=0 "(?P<SentMail>Sent mail to*)" | eval count=mvcount(SentMail) | stats sum(count) as Total

erritesh17
Path Finder

hey somesoni,

This query is working fine , can you tell me any other alternative to find events contain several occurrences string.

0 Karma

smiehe
New Member

No, the format is as follows within a single event:

Sent mail to user1@mail.com (205ms)
Rendered user_mailer/email.html.erb (22.4ms)
Sent mail to user2@mail.com (196ms)
Rendered user_mailer/email.html.erb (22.4ms)

In this case I'd need to count this as two occurrences

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

Is there some kind of delimiter? because if there is, then you want to make a multivalue field and then create a field that holds the number of values... then you can sum on that field. If you show a few lines of the log, I can be more specific...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...