Splunk Search

How can I group multiple values from repeated fields in the same log?

grevortex
Engager

Hi all,

I would like to know if there is a way to group multiple values from repeated fields that are coming in the same log, for example, taking into account the following log event containing the following data:

Log1: moduleName="Module A" moduleType="TypeA" moduleName="Module B" moduleType="TypeB"

Log2: moduleName="Module C" moduleType="TypeC" moduleName="Module A" moduleType="TypeA"

I tried something like:

app_search_criteria | stats count by moduleName | sort -count

But this way it's only bringing data for the first moduleName field it finds in one log and not for all of them, for example, I'm getting the following table:

moduleName         count

ModuleA                     1

ModuleC                     1

The ideal approach would be:

moduleName         moduleType       count

ModuleA                      TypeA                   2

ModuleB                      TypeB                   1

ModuleC                      TypeC                   1

Thanks in advance!

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
app_search_criteria 
| rex max_match=0  "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")"
| mvexpand nametype
| rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\""
| stats count by moduleName moduleType 
| sort -count

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
app_search_criteria 
| rex max_match=0  "(?<nametype>moduleName=\"[^\"]+\" moduleType=\"[^\"]+\")"
| mvexpand nametype
| rex field=nametype "moduleName=\"(?<moduleName>[^\"]+)\" moduleType=\"(?<moduleType>[^\"]+)\""
| stats count by moduleName moduleType 
| sort -count
0 Karma

grevortex
Engager

Hi @ITWhisperer , thanks very much that did the trick!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...