Help on Splunk query - Splunk Community

Splunk Search

Hi,
I have 4 fields in my index
ID, Method, URL, HTTP_responsecode

ID is in the form of XXXX-YYYY-ZZZZ-AAAA,
Now, I want to delimit the ID column and extract YYYY value then run a stats command with the delimited value by HTTP_responsecode

Something as below

Delimited_ID	HTTP_responsecode	Count
YYYY	200	10

Please could you help on how to delimit the value in the above format mentioned and how to use the new delimited value in a stats command

There are a couple of ways to get the desired field from the ID.

| rex field=ID "-(?<Delimited_ID>[^-]+)"
``` OR ```
| eval tmp = split(ID, "-")
| eval Delimited_ID = mvindex(tmp,1)

Use the new field in a stats command just as you would any other field.

| stats count as Count by Delimited_ID, HTTP_responsecode

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...