Splunk Search

How to count values across multiple similarly named fields

o_cardoso
Engager

Hi!

Given 2 events:

SummaryDialog Component1=wxt_12 Component2=wyt_1 Component3=wzt_3 Component4=wbt_2

SummaryDialog Component1=wyt_2 Component2=wxt_12 Component3=wbt_2 Component4=wzt_1

 

I'm trying to get a summary of the occurrences of each unique value regardless of the component:

wbt_2 2

wxt_12 2

wyt_1 1

wyt_2 1

wzt_3 1

wzt_6 1

Naively, I hoped this would work:

index=cls_preprod SummaryDialog | stats count by component*

 

It does not (returns no results).  Does anyone have any suggestions?  I've been googling for awhile and have not hit upon a viable solution. Note there a N number of components

Thanks!

(and forgive me if this is a basic question.. i am very basic splunk user)

 

Labels (1)
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "Component[^=]+=(?<component>\S+)"
| stats count by component

View solution in original post

o_cardoso
Engager

works great, thanks!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex max_match=0 "Component[^=]+=(?<component>\S+)"
| stats count by component
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...