Splunk Search

How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

murthychitturi
New Member

I want to find out the count of events that have field with "ctx.props.Name" has either string syniverse/openmarket , with timeout string

field=
ctx.props.Name= 
 and values of the field  = test.openmarket.seesion.4,  test.syniverse.session2 , test.openmarket.seesion.1,  test.syniverse.session3 

i need to ignore the pre and post strings before syniverse and openmarket

I have tried eval, split and other commands , but it wasn't working.

Final output should look like below:

aggregator count

openmarket 3

syniverse 5

Sample data:

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.2","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.4","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession

{"v":"1.0.1","time":"2016-04-29T04:24:15.692Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Openmarket.Session.4","SystemId":"1234567890OM","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)","at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)","at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)","at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try one of this

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | eval aggregator=if(match('ctx.props.Name',"openmarket"),"openmarket","syniverse") |stats count by aggregator

OR

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | rex field=ctx.props.Name "\.(?<aggregator>(openmarket|syniverse))\." |stats count by aggregator
0 Karma

peter7431
Explorer

Hey try adding this. It should extract the "aggregator" name from the original field, and then you do a simple stats count on the new field.

| rex field=myfield ".+\.(?<newfield>.+)\." | stats count by newfield
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

I don't think your JSON field is properly formatted so I did have to append "} at the end.
In any case, see if this helps:

| stats count
| fields - count
| eval myJSONfield = "
{\"v\":\"1.0.1\",\"time\":\"2016-04-29T04:24:15.692Z\",\"level\":\"ERROR\",\"thread\":\"pool-24-thread-1\",\"loggerName\":\"brickhouse.sms.gateway.smpp.SmppGateway\",\"ctx\":{\"msg\":\"Unable to bind SmppGateway\",\"props\":{\"Name\":\"Test.Openmarket.Session.4\",\"SystemId\":\"1234567890OM\",\"Port\":\"2776\",\"Host\":\"10.27.\",\"Type\":\"TRANSCEIVER\"},\"err\":{\"detail\":\"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]\",\"strackTraceElements\":[\"at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)\",\"at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)\",\"at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre\"}
"
| spath input=myJSONfield
| rex field=ctx.props.Name "(?i)(?<name>\w+)\.Session\.(?<timeout>\d+)$"
| table name, timeout

The above will give you one entry per event as follows:

name    timeout
Openmarket  4 

Then simply do:

stats sum(timeout) as total_timeout by name

Hope that helps.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...