How to create unique event?

[alexeysharkov]

Hello! 

I have some events just like this

2023-06-20 17:25:35.878 INFO Trace:[::] [#kafka-producer-network-thread | producer-e200fa4e-5ab6-4094-9524-035f5b697a0c][KafkaSender]: KafkaSender.sendAsync(): Message acknowledged [ topic=lcs.payment-order-request.v1, key=null, value={"contractNr": "1111111", "cuid": "222222", "action": "Remove"}, partition=3, offset=1257052]

2023-06-20 17:28:35.878 INFO Trace:[::] [#kafka-producer-network-thread | producer-e200fa4e-5ab6-4094-9524-XXXX][KafkaSender]: KafkaSender.sendAsync(): Message acknowledged [ topic=lcs.payment-order-request.v1, key=null, value={"contractNr": "1111111", "cuid": "222222", "action": "Remove"}, partition=3, offset=1257052]

I have to calc uniq counts of events with action "Remove" and "Create"

I wrote search but  it calc all events :

index = "hcg_loxon_prod" sourcetype="loxon:lcs:app_financial" topic=lcs.payment-order-request.v1 #kafka-producer-network-thread | stats count AS Total count(eval(searchmatch("Create"))) AS Create count(eval(searchmatch("Remove"))) AS Remove

"contractNr": "1111111", "cuid": "222222", "action": "Remove" - that's like unique key

How i can calc all uniq events (contractNr, cuid, action) ?

[alexeysharkov]

Thanks ! All variants work

[isoutamo]

Again excellent example how you can solve issue with different ways in Splunk 😉

You should accept one of those to help other community users to see that there is accepted solution for this question!

Happy Splunking!

[gcusello]

Hi @alexeysharkov,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[isoutamo]

Hi

If those are your _raw events on splunk, then you could try something like this

| makeresults
| eval _raw="2023-06-20 17:25:35.878 INFO Trace:[::] [#kafka-producer-network-thread | producer-e200fa4e-5ab6-4094-9524-035f5b697a0c][KafkaSender]: KafkaSender.sendAsync(): Message acknowledged [ topic=lcs.payment-order-request.v1, key=null, value={\"contractNr\": \"1111111\", \"cuid\": \"222222\", \"action\": \"Remove\"}, partition=3, offset=1257052]
2023-06-20 17:28:35.878 INFO Trace:[::] [#kafka-producer-network-thread | producer-e200fa4e-5ab6-4094-9524-XXXX][KafkaSender]: KafkaSender.sendAsync(): Message acknowledged [ topic=lcs.payment-order-request.v1, key=null, value={\"contractNr\": \"1111111\", \"cuid\": \"222222\", \"action\": \"Remove\"}, partition=3, offset=1257052]
2023-06-20 17:30:35.878 INFO Trace:[::] [#kafka-producer-network-thread | producer-e200fa4e-5ab6-4094-9524-XXXX][KafkaSender]: KafkaSender.sendAsync(): Message acknowledged [ topic=lcs.payment-order-request.v1, key=null, value={\"contractNr\": \"1111111\", \"cuid\": \"222222\", \"action\": \"Create\"}, partition=3, offset=1257052]"
| multikv noheader=t
``` above create sample events ```
| kv
| spath input=value
| stats count by contractNr action

r. Ismo 

[gcusello]

Hi @alexeysharkov,

you have to use a regex like the following:

| rex "\"contractNr\":\s+\"(?<contractNr>\d+)\",\s+\"cuid\":\s+\"(?<cuid>\d+)\",\s+\"action\":\s+\"(?<action>[^\"]+)\""

that you can test at https://regex101.com/r/mV6tU0/1

Ciao.

Giuseppe

[ITWhisperer]

| rex "value=(?<value>[^}]+})"
| spath input=value
| stats count by action contractNr cuid