- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to count the number of dots in a domain name
For exmaple:
www.host.com = 2
host.com = 1
Is there an easy eval command to count the number of occurrences of a particular character in a event?
Thank you,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Bro,
It was fun to find a solution to your question. I made the below query to check it out. Modify this to your requirement.
Run the below query in your splunk search
index=main | head 1 | eval custom_test="This . is . Eashwar . Raghunathan . and . i . am . playing . with . 10 . dots" | rex mode=sed field=custom_test "s/[^.]/X/g s/X//g" | eval NumberOfDots=len(custom_test) | table custom_test NumberOfDots
Hope in your case you will pass the string domain instead of custom_test
Happy splunking bro, thanks for asking tough questions 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello AELLIOTT it is working now for me, I don't know why it did not work yesterday 😞 ... Confused
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey i did it first, for some reason it did not work. It was unusual, so i was trying a couple of other ways to achieve the same
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could just have "s/[^.]//g" in your sed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
someone else had this issue, and this worked for them:
http://answers.splunk.com/answers/28276/count-of-character-in-field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect! thank you!