Given the following log entry how would a find the number of host entries and assign it to a field?
Thanks!
FINEST|1137/0|Service KOALA-MANGOES|13-12-14 00:13:35|INFO: Available nodes: [host :htti://10.0.46.107:5555 time out : 30000, host :htti://10.0.46.103:5555 time out : 30000, host :htti://10.0.46.106:5555 time out : 30000, host :htti://10.0.49.52:5555 time out : 30000, host :htti://10.0.49.176:5555 time out : 30000, host :htti://10.0.49.53:5555 time out : 30000, host :htti://10.0.39.21:5555 time out : 30000, host :htti://10.0.39.17:5555 time out : 30000, host :htti://10.0.39.19:5555 time out : 30000, host :htti://10.0.49.51:5555 time out : 30000, host :htti://10.0.39.20:5555 time out : 30000, host :htti://10.0.33.62:5555 time out : 30000, host :htti://10.0.39.18:5555 time out : 30000, host :htti://10.0.46.105:5555 time out : 30000, host :htti://10.0.50.102:5555 time out : 30000, host :htti://10.0.46.104:5555 time out : 30000, host :htti://10.0.49.54:5555 time out : 30000]
I would suggest that you extract the host values as a multi-valued field.
Then you can find out the number of hosts by using the mvcount()
function for eval
.
... | eval XXX = mvcount(servers)
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
/K
I would suggest that you extract the host values as a multi-valued field.
Then you can find out the number of hosts by using the mvcount()
function for eval
.
... | eval XXX = mvcount(servers)
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions
/K
Thanks. That did the trick. I am now trying to do it in a calculated field such as
mvcount( SPLIT(nodes, ",") )
but am getting an error on the web ui. This is tracked in another question. Thanks again.