Splunk Search

How to count number of occurrences of string in single event and group as per count ?

splunkDevendra
Explorer

 

I want to find out How many times string appeared in ONE SINGLE EVENT.
and group all the events and find table like :

Attempts        : Count :
1                            100
2                            342
3                            201
4                            04
5                            00

how to write query for this ?


Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Here is an example of how you can count the number of attempts.aggrStatus elements in each object

| makeresults
| eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}"
| rex field=_raw "objectA\":(?<json>.*)"
| spath input=json
| eval attempts=mvcount('attempts{}.aggrStatus')

assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.

Then you just need to add the following to your search to get the counts

| stats count by attempts
| sort attempts

 

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

splunkDevendra
Explorer

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?

0 Karma

splunkDevendra
Explorer

found following working 

 

| stats count as Count by attempts
| eventstats sum(Count) as Total
| eval perc=round((Count/Total)*100,2)
| fields - Total
| sort 0 - Count
| head 10

0 Karma

splunkDevendra
Explorer

How to minus one attempt from final table as it counts 1 extra attempt in every event

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval attempts=mvcount(status)-1
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...