Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How can i extract words and their count from a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a table which has fields defects and summary that gives me the summary of the defects. I want to extract some words from summary and their count as well. Please help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Considering you are only checking the issue_type and summary fields and you know the values you are looking for (i.e. words like Bug, Reopened etc.), you can do it this way -
<your search> | eval details=issue_type.summary | rex max_match=0 field=details "(?<word>(?i)(Bug|Reopened|Closed))" | stats count by word
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Considering you are only checking the issue_type and summary fields and you know the values you are looking for (i.e. words like Bug, Reopened etc.), you can do it this way -
<your search> | eval details=issue_type.summary | rex max_match=0 field=details "(?<word>(?i)(Bug|Reopened|Closed))" | stats count by word
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks Dinesh. It works fine . Modified the query a bit as i did not want it on issue_type field.Just summary would do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great!! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide a sample of your data and the output you are expecting?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sure .
my table:
key issue_type summary
SPJ-171 Bug Reopened n for aaam
SPJ-18 Bug Reopened_m for AAAM
SPJ-19 Bug Bug 2
SPJ-19 Bug Reopened x for aaam
expected (eg):
word count
Reopned 3
Bug 5 etc.
The words are from the summary field. Hope I am clear 🙂
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
