Splunk Search

How get a total count based on the substring value?

Sureshp191
Explorer

Below is the splunk query,  (My.Message has many various types of messages but the below one is what I wanted)

index="myIndex" app_name="myappName"  My.Message = "*symbolName:*" 

When I run the above query, I get the below results:

myappstatus got Created, symbolName: AAPL ElapsedTime: 0.0002009

myappstatus got Ended, symbolName: GOOGL ElapsedTime: 0.0005339

myappstatus got Created, symbolName: AAPL ElapsedTime: 0.0005339

Please help on the following: 
1) How to get the Total count of the query (Visualization) only for My.Message = "*symbolName:*" 
2) How to split the string "myappstatus got Created, symbolName: AAPL ElapsedTime: 0.0002009" 
3) How to create a table for "symbolName", "Total Count", "ElapsedTime"

(for example, symbolName: AAPL, Total Count = 2 and ElapsedTime = 0.0007348 (0.0002009 + 0.0005339)

Thanks

Labels (2)
Tags (2)
0 Karma
1 Solution

yeahnah
Motivator

Hi @Sureshp191 

OK, to dedup  results do it this way...

index="myIndex" app_name="myappName"  My.Message = "*symbolName:*" 
| rex "symbolName: (?<symbolName>\w+) ElapsedTime: (?<ElapsedTime>[^\s]+)"
| stats count AS "Total Count" sum(ElapsedTime) AS "Total ElapsedTime" BY symbolName

 

View solution in original post

0 Karma

yeahnah
Motivator

Hi @Sureshp191 

Based on the example events provided, here's some demonstration run anywhere code showing a method to do what you want...

| makeresults
| eval raw="myappstatus got Created, symbolName: AAPL ElapsedTime: 0.0002009
myappstatus got Ended, symbolName: GOOGL ElapsedTime: 0.0005339
myappstatus got Created, symbolName: AAPL ElapsedTime: 0.0005339"
| eval raw=split(raw, "
")
| mvexpand raw
| rename raw AS _raw
  ``` the above is just creating dummy events to test the following SPL code with ```
| rex "symbolName: (?<symbolName>\w+) ElapsedTime: (?<ElapsedTime>[^\s]+)"
| eventstats count AS "Total Count" list(ElapsedTime) AS listElapsedTime sum(ElapsedTime) AS "Total ElapsedTime" BY symbolName
| table symbolName "Total Count" "Total ElapsedTime"

 Hope that helps

0 Karma

Sureshp191
Explorer

Thanks, I got the output but symbolName AAPL is duplicatedSnag_682940b.png

0 Karma

yeahnah
Motivator

Hi @Sureshp191 

OK, to dedup  results do it this way...

index="myIndex" app_name="myappName"  My.Message = "*symbolName:*" 
| rex "symbolName: (?<symbolName>\w+) ElapsedTime: (?<ElapsedTime>[^\s]+)"
| stats count AS "Total Count" sum(ElapsedTime) AS "Total ElapsedTime" BY symbolName

 

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...