Splunk Search

Extract a value from a string?


I'm fairly new to Splunk and I looked at the possible "Questions that may already have your answer?" and didn't find something clear or looked like what I needed.

This is my string that I'm trying to get out of a log from an application:

15-Sep-2015 09:29:22 MyApplication Successful Delivery to Destination XXXXXXX Batch No 459 (DR ID: 194)

The goal is to get a count of these messages for each value in XXXXXXX - so I would then
have something like (of course in a nice graph 🙂
XXXXXX1 : 304
XXXXXX2 : 984
XXXXXX3 : 543

0 Karma

Re: Extract a value from a string?


Try this

your base search | rex "Delivery to Destination (?<Destination>[^\s]+)" | stats count by Destination