Extract a value from a string?

schu777 · ‎09-15-2015

I'm fairly new to Splunk and I looked at the possible "Questions that may already have your answer?" and didn't find something clear or looked like what I needed.

This is my string that I'm trying to get out of a log from an application:

15-Sep-2015 09:29:22 MyApplication Successful Delivery to Destination XXXXXXX Batch No 459 (DR ID: 194)

The goal is to get a count of these messages for each value in XXXXXXX - so I would then
have something like (of course in a nice graph 🙂
XXXXXX1 : 304
XXXXXX2 : 984
XXXXXX3 : 543

somesoni2 · ‎09-15-2015

Try this

your base search | rex "Delivery to Destination (?<Destination>[^\s]+)" | stats count by Destination

Extract a value from a string?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Join the Conversation

Extract a value from a string?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent