Splunk Search
Highlighted

How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

New Member

I want to find out the count of events that have field with "ctx.props.Name" has either string syniverse/openmarket , with timeout string

field=
ctx.props.Name= 
 and values of the field  = test.openmarket.seesion.4,  test.syniverse.session2 , test.openmarket.seesion.1,  test.syniverse.session3 

i need to ignore the pre and post strings before syniverse and openmarket

I have tried eval, split and other commands , but it wasn't working.

Final output should look like below:

aggregator count

openmarket 3

syniverse 5

Sample data:

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.2","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.

{"v":"1.0.1","time":"2016-04-29T04:24:27.104Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Syniverse.Session.4","SystemId":"1234567890","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession

{"v":"1.0.1","time":"2016-04-29T04:24:15.692Z","level":"ERROR","thread":"pool-24-thread-1","loggerName":"brickhouse.sms.gateway.smpp.SmppGateway","ctx":{"msg":"Unable to bind SmppGateway","props":{"Name":"Test.Openmarket.Session.4","SystemId":"1234567890OM","Port":"2776","Host":"10.27.","Type":"TRANSCEIVER"},"err":{"detail":"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]","strackTraceElements":["at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)","at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)","at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)","at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)","at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)","at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre
0 Karma
Highlighted

Re: How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

SplunkTrust
SplunkTrust

Hi,

I don't think your JSON field is properly formatted so I did have to append "} at the end.
In any case, see if this helps:

| stats count
| fields - count
| eval myJSONfield = "
{\"v\":\"1.0.1\",\"time\":\"2016-04-29T04:24:15.692Z\",\"level\":\"ERROR\",\"thread\":\"pool-24-thread-1\",\"loggerName\":\"brickhouse.sms.gateway.smpp.SmppGateway\",\"ctx\":{\"msg\":\"Unable to bind SmppGateway\",\"props\":{\"Name\":\"Test.Openmarket.Session.4\",\"SystemId\":\"1234567890OM\",\"Port\":\"2776\",\"Host\":\"10.27.\",\"Type\":\"TRANSCEIVER\"},\"err\":{\"detail\":\"com.cloudhopper.smpp.type.SmppTimeoutException: Unable to get response within [5000 ms]\",\"strackTraceElements\":[\"at com.cloudhopper.smpp.impl.DefaultSmppSession.sendRequestAndGetResponse(DefaultSmppSession.java:471)\",\"at com.cloudhopper.smpp.impl.DefaultSmppSession.bind(DefaultSmppSession.java:334)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.doBind(DefaultSmppClient.java:215)\",\"at com.cloudhopper.smpp.impl.DefaultSmppClient.bind(DefaultSmppClient.java:196)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.bindSession(SmppGateway.java:89)\",\"at com.west.brickhouse.sms.gateway.smpp.SmppGateway.init(SmppGateway.java:75)\",\"at com.west.brickhouse.sms.gateway.AbstractSmsGatewayService.cre\"}
"
| spath input=myJSONfield
| rex field=ctx.props.Name "(?i)(?<name>\w+)\.Session\.(?<timeout>\d+)$"
| table name, timeout

The above will give you one entry per event as follows:

name    timeout
Openmarket  4 

Then simply do:

stats sum(timeout) as total_timeout by name

Hope that helps.

0 Karma
Highlighted

Re: How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

Explorer

Hey try adding this. It should extract the "aggregator" name from the original field, and then you do a simple stats count on the new field.

| rex field=myfield ".+\.(?<newfield>.+)\." | stats count by newfield
0 Karma
Highlighted

Re: How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

SplunkTrust
SplunkTrust

Try one of this

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | eval aggregator=if(match('ctx.props.Name',"openmarket"),"openmarket","syniverse") |stats count by aggregator

OR

index=foo sourcetype=bar  ctx.props.Name="*openmarket*" OR ctx.props.Name="*syniverse*" | rex field=ctx.props.Name "\.(?<aggregator>(openmarket|syniverse))\." |stats count by aggregator
0 Karma
Highlighted

Re: How to extract the count of events to look for one or two specific strings and ignore the rest of the text in the fields?

SplunkTrust
SplunkTrust

Hi, did any of the comments below help you on this?
If yes, can you mark it as answered?
If not, is there any else we can do to help?

0 Karma