Splunk Search

Find the most common individual characters in a field

suspicious_link
New Member

Hi longtime splunker, first time poster

so my goal here is to find the most common and uncommon characters in a field across multiple events.

event1: commandline="the quick brown fox"

event2: commandline="jumped over the lazy dog"

the search i've tried

 

index=data | fields command_line | rex field=command_line "(?<cmd_char>.)" | top cmd_char

 

this rex only pulls the first char from the field and would want to pull numbers from the whole commandline

results from top (or whatever function):

char (with " cause spaces would be hard to see here) | count

" "  | 7

"e" | 3

"t" | 2

"u" | 2

"h" | 1

"q" | 1

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You want the max_match parameter to rex

| makeresults 
| eval commandline=split("the quick brown fox :jumped over the lazy dog",":")
| mvexpand commandline
| rex field=commandline max_match=0 "(?<cmd_char>.)" 
| top cmd_char

Hope this helps 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...