Splunk Search

How to ensure the linecount is updated after removing lines in a rex search?

kmorton
New Member

I've got some events with some lines in it that I don't want displayed, so I'm removing those with a rex sed statement inline to the search. The trick is that I want the linecount to also update. Is there any way to do this? My generic search is below, though it could be any sed statement to remove lines.

search expression
| rex mode=sed "s/[\n\r]*\s*at .*//g" 
| rex mode=sed "s/[\n\r]*\s*java.*//g"
Tags (4)
0 Karma

woodcock
Esteemed Legend

You can do it in one line like this:

... | eval linecount=mvcount(split(_raw, "
"))

Or this:

... | eval linecount=len(_raw) - len(replace(_raw, "[\r\n]+", "")) + 1

dmarling
Builder

Give this a try. It's very straight forward:

| rex max_match=0 "(?<linebreaks>\n+)"
| eval adjustedlinecount=mvcount(linebreaks)

It is extracting every line break in the event and then the adjustedlinecount field is counting how many linebreaks get returned on each event since the max_match is causing the linebreaks field to be multivalued.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...