Splunk Search

Filter out results from report using "rex _raw" and "stats count(eval(match(AA,""))) AS "ABC"" and filter out results with "count=0"

srishtiarora
New Member

Hi,

I am looking to filter out the contents of Search results that is using rex, transpose and count.
we are having multiple results with count 0 and need to be removed from report as its occupying majority of dashboard.

Below is Command sample:

table  "_raw"  | rex  field=_raw "(?PCode1)"  | rex  field=_raw "(?PCode2)" | rex  field=_raw " (?PCode3) " | stats  count(eval(match(AA,"")))  AS "Message1",  count(eval(match(AB,".*"))) AS "Message2" ,  count(eval(match(AC,".*"))) AS "Message3" |transpose

i am not sure how i can filter out this as where count>0 is not working.

0 Karma

somesoni2
Revered Legend

Firstly, to ensure the whole search/code/result that you add in your question is completely shown, you should select the query/code/result part and press Ctrl +K OR click on "101 100" button on top of the text box.

Please ensure that you confirm the rex portions and try this.

...your base search | table "_raw" | rex field=_raw "(?P<AA>Code1)" | rex field=_raw "(?P<AB>Code2)" | rex field=_raw " (?P<AC>Code3) " | stats count(eval(match(AA,""))) AS "Message1", count(eval(match(AB,"."))) AS "Message2" , count(eval(match(AC,"."))) AS "Message3" | eval temp=1 | untable temp Message Count | where count>0 | fields - temp

If an event only contains one Code (a row will have only one of AA, AB or AC, then try this version

...your base search | table "_raw" | rex field=_raw "(?P<Message>(Code1|Code2|Code3))" | stats count by Message | where count>0 
0 Karma

srishtiarora
New Member

The Code 1 to Code 3 and Message1 to message3 are just aliases as it cannot be shared, but they hold different values and there is no string with Message in them.
when I tried adding eval temp=1 | untable temp Message Count | where count>0 | fields - temp, it didn't work.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...