How to get a log pattern count?

[srinij]

Hi,

I have a log pattern like this

requrl : serviceName: abcd key: xyz-abc-def header: http
requrl : serviceName: efgh key: abc-asd-sssd header: http
requrl : serviceName: 1234 key: abc-1234-sssd header: http

I would like to find the unique pattern on the above. The above pattern can be duplicated - like the first line can be multiple times.

For example, I would need a table which says

serviceName key

abcd xyz-abc-def
efgh abc-asd-sssd
1234 abc-1234-sssd

How would i do that? Can anyone help me here?

[gokadroid]

Try this if you want both the serviceName and the key:

base search | rex "requrl : serviceName:\s(?<serviceName>[^\s]+)\skey:\s(?<key>[^\s]+)" | stats count by serviceName, key | fields serviceName, key

[sundareshr · Accepted solution]

Assuming your data is indexed in splunk, you can use extract and dedup to get your desired results. Try this

base search | extract pairdelim=" " kvdelim=":" | table serviceName key | dedup serviceName key

[srinij]

That didn't work for me for some reason but it was a good one that helped learn about it.

[srinij]

I figured out what I looking for in a different way. Here is my solution. I got the serviceName and the count by below search query

base search | rex "requrl : serviceName: (?<ServiceName>[^\s]+)" | stats count by ServiceName

[inventsekar]

Hi Srini.. please update us some more info..what is the unique pattern on this above log pattern..

[srinij]

Hi Sekar, I just updated the info!

[srinij]

Hi,

I have a log pattern like this

requrl : serviceName: **abcd** key: **xyz-abc-def** header: http
requrl : serviceName: **efgh** key: **abc-asd-sssd** header: http
requrl : serviceName: **1234** key: **abc-1234-sssd** header: http

The above log lines follow the pattern - requrl : serviceName: **** key: **** header: http
The bold items are values that changes.

I would like to find the unique pattern on the above. The above pattern can be duplicated - like the first line can be multiple times.

I would need a table which prints that serviceName and key. Also would like to ignore the duplicate entries.So, if the same line prints in the log multiple time, i would like to have only one entry in the table.

serviceName key

abcd xyz-abc-def
efgh abc-asd-sssd
1234 abc-1234-sssd

How would i do that? Can anyone help me here?

[aaraneta_splunk]

Hi @srinij - It looks like your post is missing information. You mention, "I would like to find the unique pattern like this" and nothing else is written. You will likely need to provide more information to the Answers community about what you would want your expected result to look like so that users can better help you. Thanks.

[srinij]

@aaraneta - I just added more information. sorry about that!