Splunk Search

How can I get a count of words in an event?

daniel333
Builder

All,

Weird search. How can I get a count of words in an event?

e.g.
_raw = "Hello world. Hello state. Hello France"

outputs -
Hello = 3
world = 1
state = 1
France = 1

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

Try this

... | rex max_match=0 "(?<words>\w+)" | mvexpand words | stats count by words

View solution in original post

0 Karma

sundareshr
Legend

Try this

... | rex max_match=0 "(?<words>\w+)" | mvexpand words | stats count by words
0 Karma

daniel333
Builder

How does max_match=0 work?

0 Karma

sundareshr
Legend

By default rex command will only get the first instance. max_match Controls the number of times the regex is matched. It will match all (max_match=0) instances put the values in a multivalue field.

http://docs.splunk.com/Documentation/Splunk/6.0.5/SearchReference/Rex

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...