Splunk Search

How to count number of occurrences of string in single event and group as per count ?

splunkDevendra
Explorer

 

I want to find out How many times string appeared in ONE SINGLE EVENT.
and group all the events and find table like :

Attempts        : Count :
1                            100
2                            342
3                            201
4                            04
5                            00

how to write query for this ?


Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Here is an example of how you can count the number of attempts.aggrStatus elements in each object

| makeresults
| eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}"
| rex field=_raw "objectA\":(?<json>.*)"
| spath input=json
| eval attempts=mvcount('attempts{}.aggrStatus')

assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.

Then you just need to add the following to your search to get the counts

| stats count by attempts
| sort attempts

 

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

splunkDevendra
Explorer

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?

0 Karma

splunkDevendra
Explorer

found following working 

 

| stats count as Count by attempts
| eventstats sum(Count) as Total
| eval perc=round((Count/Total)*100,2)
| fields - Total
| sort 0 - Count
| head 10

0 Karma

splunkDevendra
Explorer

How to minus one attempt from final table as it counts 1 extra attempt in every event

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval attempts=mvcount(status)-1
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...