Splunk Search

How do I rename and extract multiple data from a search?

virgilg
Explorer

I have log lines of the form (relevant excerpt only, they contain also hostname, timestamp, etc):

data_name: A B C D E
data_name: A
data_name: A C D

basically, data_name is a collection of strings in a set that may or may not be present for a particular log line.

I want to extract several things:
1) the entries that have A
2) the entries that have A but not C in the same line
3) all possible entries

and display their count (and e.g. hostname) in a chart.

I've tried:

( data_name AND A ) OR ( data_name AND A NOT B ) | dedup host

but this gives me results that are not distinguishable. How can I rename the first predicate (left of OR) so I can apply a "count" to it, and do the same for the second predicate (right of OR) and the third, and the fourth, etc.
Is this the right approach?

0 Karma

sundareshr
Legend

Try this (you will need to adjust the regex)

base search | rex "data_name\:\s(?<data_name>.*) | eval OnlyA=if(match(data_name, "\bA\b"), 1, 0) | eval A_No_C=if(match(data_name, "\bA\b" AND NOT match(data_name, "\bC\b"), 1, 0) | stats count sum(OnlyA) as OnlyA sum(A_No_C) as A_No_C
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...