Splunk Search

How do I rename and extract multiple data from a search?

virgilg
Explorer

I have log lines of the form (relevant excerpt only, they contain also hostname, timestamp, etc):

data_name: A B C D E
data_name: A
data_name: A C D

basically, data_name is a collection of strings in a set that may or may not be present for a particular log line.

I want to extract several things:
1) the entries that have A
2) the entries that have A but not C in the same line
3) all possible entries

and display their count (and e.g. hostname) in a chart.

I've tried:

( data_name AND A ) OR ( data_name AND A NOT B ) | dedup host

but this gives me results that are not distinguishable. How can I rename the first predicate (left of OR) so I can apply a "count" to it, and do the same for the second predicate (right of OR) and the third, and the fourth, etc.
Is this the right approach?

0 Karma

sundareshr
Legend

Try this (you will need to adjust the regex)

base search | rex "data_name\:\s(?<data_name>.*) | eval OnlyA=if(match(data_name, "\bA\b"), 1, 0) | eval A_No_C=if(match(data_name, "\bA\b" AND NOT match(data_name, "\bC\b"), 1, 0) | stats count sum(OnlyA) as OnlyA sum(A_No_C) as A_No_C
0 Karma
Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...