Splunk Search

How to add a column to a stats table using rex

harshparikhxlrd
Path Finder

I'm fairly new to splunk and have just learned how to use the rex/regex. I am trying to add a column in my string search to a statistics table to display the name of the workstation. This is my current string.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi harshparikhxlrd
if the field you want i ComputerName, probably you already have because Splunk recognize by itself the pair field=value.
Anyway the regex to extract Computername is:

| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task"

that you can test at https://regex101.com/r/0n0rks/1

So your search will be (sorry I cannot rewrite your regex because I cannot see it, use Code Sample button to share regexes):

index=monitoring sourcetype=PEGA:WinEventLog:Application ( SourceName="RoboticLogging" OR SourceName="Application" ) ("Department=" "HRSS_STL") ("Type=" "Error") 
| rex "Message : (?.+.?)" 
| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task"
| stats count by ex 
| rename ex as Exception 

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi harshparikhxlrd
if the field you want i ComputerName, probably you already have because Splunk recognize by itself the pair field=value.
Anyway the regex to extract Computername is:

| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task"

that you can test at https://regex101.com/r/0n0rks/1

So your search will be (sorry I cannot rewrite your regex because I cannot see it, use Code Sample button to share regexes):

index=monitoring sourcetype=PEGA:WinEventLog:Application ( SourceName="RoboticLogging" OR SourceName="Application" ) ("Department=" "HRSS_STL") ("Type=" "Error") 
| rex "Message : (?.+.?)" 
| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task"
| stats count by ex 
| rename ex as Exception 

Ciao.
Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi harshparikhxlrd,
Try now:

index=monitoring sourcetype=PEGA:WinEventLog:Application ( SourceName="RoboticLogging" OR SourceName="Application" ) ("Department=" "HRSS_STL") ("Type=" "Error") 
| rex "(?ms)ComputerName\=(?<Computername>[^ ]*)Task.*Message\=(?<Message>.*)"
| stats stats values(Message) As Message values(Computername) AS Computername count by ex 
| rename ex as Exception 

That you can test at https://regex101.com/r/0n0rks/2 .

Ciao.
Giuseppe

0 Karma

harshparikhxlrd
Path Finder

Adding to previous post:

Message=

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...