Splunk Search

How do I cut a string after a certain text and count the results of the string before the cut?

iambobwall
New Member

Here is my current search in Jboss Logs:

index=jboss_app CLASS="foo.bar.bas.classname" MESSAGE="Error doing the thing bob wants to do" OR MESSAGE="Error doing the thing joe wants to do"|stats count by MESSAGE |sort - count

Results show

Error doing the thing for **bob** :user1@company.com AccountNumber01: 4920406079372  13
Error doing the thing for **bob** :user2@company.com AccountNumber01: 4079379507040  12
Error doing the thing for **joe** :user3@company.com AccountNumber01: 1040683729965  11 
Error doing the thing for **joe** :user4@company.com AccountNumber01: 60284967030205  10 

The results I want are to simply count how many results show "Error doing the thing for bob" and "Error doing the thing for joe" and list it as such. Just need to count how many for each.

Thanks!

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@iambobwall,

There are multiple ways to do using regex.

If you want "everything" before the "text", then try

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?))bob"    --  Result : Error doing the thing

^(.*?) will match everything until it finds the text bob. This could be used if you have a common string (e.g. bob) in every line. You could also use ":" to include bob also part of the string.

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?)):"    --  Result : Error doing the thing bob

OR

Use below to search for first 6 words literally if the error message's format is same.

|rex field=MESSAGE "(?P<MY_MESSAGE>(\w+\s){6})"    --  Result : Error doing the thing for bob

Try and let's know if you need any changes to these

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@iambobwall,

There are multiple ways to do using regex.

If you want "everything" before the "text", then try

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?))bob"    --  Result : Error doing the thing

^(.*?) will match everything until it finds the text bob. This could be used if you have a common string (e.g. bob) in every line. You could also use ":" to include bob also part of the string.

|rex field=MESSAGE "(?P<MY_MESSAGE>^(.*?)):"    --  Result : Error doing the thing bob

OR

Use below to search for first 6 words literally if the error message's format is same.

|rex field=MESSAGE "(?P<MY_MESSAGE>(\w+\s){6})"    --  Result : Error doing the thing for bob

Try and let's know if you need any changes to these

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

iambobwall
New Member

I tried the "rex" option and it worked like a charm. Thank you!

|rex field=MESSAGE "(?P <\MULTI_SINGLE>\ (\w+\s){11})"|stats count by MULTI_SINGLE|sort - count

Gives me exactly the format and information I am looking for.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...