Splunk Search

Extract field from another dynamic field

thenormalone
Path Finder

I have a field from the search query called source which has a pattern of "text:text:text:dynamicText:dynamicText:dynamicText"

where text->hardcoded values and dynamicText->keeps changing for different logs.

 

I want to extract the 2nd dynamic text as its own field and then perform a stats count on that field. 

I'm not able to figure out how to navigate over the 1st dynamic field using regular expressions

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can use rex to extract the second dynamicText and then use the stats command to count them.

index=foo
| rex "(?:[^:]+:){4}(?<dynamicText2>[^:]+)"
| stats count by dynamicText2
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can use rex to extract the second dynamicText and then use the stats command to count them.

index=foo
| rex "(?:[^:]+:){4}(?<dynamicText2>[^:]+)"
| stats count by dynamicText2
---
If this reply helps you, Karma would be appreciated.

thenormalone
Path Finder

@richgalloway  so this is a result from one of the indexers from which I extract this dynamic field while another indexer already has the field in its search. So how do I go about combining them?

I tried renaming the dynamic field (eg: "source") which I extract from the 1st indexer with the same name as the field from the search result of the other indexer (also named "source") but when I do "| stats count source", it shows up as two different results even though the name of the source is the same. 

0 Karma

thenormalone
Path Finder

there was a typo in my search, it did combine the results

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...