Splunk Search

How to count specific data separated by pipe character ?

Linnie25
New Member

Hi,

I have below data and would like to get count by country code. Is it possible to get it ?

|21/02/2021 12:36:29.048| |INFO| |1234|guest |CA|1.10.1| [END] - DetailsLookUp

|21/02/2021 12:26:20.534| |INFO| |8669|guest |US|1.10.1| [END] - DetailsLookUp

Thanks in advance.

Labels (1)
Tags (3)
0 Karma

Linnie25
New Member

@AhmadKhattak20 @inventsekar @inventsekar 

Thanks for giving me the ideas how to work this out.

There is no field specify for the country code so I use Field Extractor and now I'm able to get the count 😊

But since I use source as Data Type I'm not able to change the Permission. From what I read it seems like there is issue when using source instead of sourcetype.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Linnie25 

If the fields are not extracted, then, you have to use rex to find out the country and then count. 

| makeresults 
| eval log="|test|13e|1234|guest |CA|1.2|test|test" 
| rex field=log "\|(?<country>\w\w)\|\d" 
| stats count by country

rex.png

0 Karma

tscroggins
Influencer

@Linnie25 

As implied, you need to extract the country code value into a field. At search time, you can use the rex command with an appropriate regular expression:

| rex "\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|[^|]*\\|(?<country_code>[^|]*)"
| stats count by country_code

0 Karma

AhmadKhattak20
Explorer

What are the fields that have been extracted for this data?

Is there any field extracted that has the country code value, if so then you can easily get the count by country code.

As an example,

If the field containing the country code is called "code", you could get the count by country code using the below SPL query, 

index=main | stats count by code

Replace the index value with the actual index in which the data is being stored. 

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...