How do I create a Splunk query that generates an overview of field combinations?

[josipj]

Hi,

I'm having difficulty creating a Splunk query that generates an overview of field combinations using regular expressions. What I'm trying to do is combine the fields 'code' and 'outCome' to a key and count the combination over a certain period of time. It is possible for the element 'code' not to be present? If that is the case, I would like to print it "NA". What I would expect the table to look like is:

Code:outCome:Occurences
NA:01:2
UNKOWN:02:1
KNOWN:01:1

Below is the Splunk query:

| makeresults
| eval _raw="<reply><result><sessiondId>1</sessiondId><resultChecks><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><code>UNKOWN</code><address><street>streetName</street></address><outCome>02</outCome></resultCheck><resultCheck><personId/><code>KNOWN</code><address><street>streetName</street></address><outCome>01</outCome></resultCheck><information><record><recordCode>1</recordCode><recordText>recordText</recordText></record></information></resultChecks></result></reply>"
| rex max_match=0 field=_raw "(code>(?<code>\w+)<\/code>.*?)?outCome>(?<outCome>.*?)<\/outCome>"
| table code, outCome

Any suggestions on how to do this?

Kind regards,

Josip

[akocak]

Here it is:

| makeresults 
| eval _raw="<reply><result><sessiondId>1</sessiondId><resultChecks><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><address><street>streetName</street></address><outCome>01</outCome></resultCheck><resultCheck><personId/><code>UNKOWN</code><address><street>streetName</street></address><outCome>02</outCome></resultCheck><resultCheck><personId/><code>KNOWN</code><address><street>streetName</street></address><outCome>01</outCome></resultCheck><information><record><recordCode>1</recordCode><recordText>recordText</recordText></record></information></resultChecks></result></reply>" 
| spath output=resultCheck path=reply.result.resultChecks.resultCheck
| mvexpand resultCheck
| rex field=resultCheck "(\<code\>(?<code>\w+)\<\/code\>)?\<address.+outCome\>(?<outCome>\d+)\<\/outCome\>"
| eval code=if(isnull(code),"NA",code)
| stats count by code,outCome