Groupby on a name-value pair within a field

[skpatnaik]

I have an oracle log file (i am pasting below one record from the log file)
I intend to a table with all possible RETURNCODE[1] values (group by on the name-value pair within the field Message) alongwith their respective count. Please help with a splunk search string

---------- 1 Record From The Log File---------------
8:09:00.000 PM

LogName=Application
SourceName=Oracle.orcl
EventCode=34
EventType=4
Type=Information
ComputerName=Linus-PC
TaskCategory=None
OpCode=None
RecordNumber=2144220
Keywords=Classic
Message=Audit trail: LENGTH: "385" SESSIONID:[6] "101355" ENTRYID:[1] "1" STATEMENT:[1] "1" USERID:[6] "DBSNMP" USERHOST:[18] "WORKGROUP\LINUS-PC" TERMINAL:[8] "LINUS-PC" ACTION:[3] "100" RETURNCODE:[1] "0" COMMENT$TEXT:[114] "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=fe80::5d33:f1be:ba6:dda3%11)(PORT=20072))" OS$USERID:[19] "NT AUTHORITY\SYSTEM" DBID:[10] "1343606950" PRIV$USED:[1] "5".

[lguinn2]

Try this

yoursearchhere
| rex field=Message "RETURNCODE:\[1\]\s\"(?<return_code>.*?)\""
| stats count by return_code

I don't know what search you need for the initial data retrieval, but source=*thefilename.ext" might work.

[kristian_kolb]

That's a Windows Event Log, so source=WinEventLog:Application SourceName=oracle.orcl would probably work better.