Splunk Search

How to get count of a field per event?

jameshgibson
Path Finder

I am using a transaction to get the start/end/duration of jobs. This gives me back about 200 events. Something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | table start, end, duration

I would like to extract the number of "tasks" that are done in in this job I use the "rex" command to get a the field:

rex field=_raw ".*(?<task>Task started).*" | stats count(task)

unfortunatly the stats command groups all the events which I dont want. I really want something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | rex field=_raw ".*(?<task>Task started).*" | eval start = _time | eval end = _time + duration | table start, end, duration, count(task)

1 Solution

Ayn
Legend

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

View solution in original post

Ayn
Legend

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

jameshgibson
Path Finder

I just want a field count within each event. I dont care if the tasks are repeated or not.

0 Karma

kristian_kolb
Ultra Champion

So you mean it's a distinct count? Then make a different field extraction through rex;

... | rex "(?.{20}).*Task started" | ...

In this case, grab the first 20 characters of your events as a unique task id (assuming there is a timestamp there - YMMV). This should do fine, if you don't really need to look a the actual values.

/kristian

0 Karma

jameshgibson
Path Finder

doesn't do what I need, it just returns 1 or 0 depending if there are any tasks in the transaction

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...