Splunk Search

How to get count of a field per event?

Path Finder

I am using a transaction to get the start/end/duration of jobs. This gives me back about 200 events. Something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | table start, end, duration

I would like to extract the number of "tasks" that are done in in this job I use the "rex" command to get a the field:

rex field=_raw ".*(?<task>Task started).*" | stats count(task)

unfortunatly the stats command groups all the events which I dont want. I really want something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | rex field=_raw ".*(?<task>Task started).*" | eval start = _time | eval end = _time + duration | table start, end, duration, count(task)

1 Solution

Legend

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

View solution in original post

Legend

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

View solution in original post

Path Finder

I just want a field count within each event. I dont care if the tasks are repeated or not.

0 Karma

Ultra Champion

So you mean it's a distinct count? Then make a different field extraction through rex;

... | rex "(?.{20}).*Task started" | ...

In this case, grab the first 20 characters of your events as a unique task id (assuming there is a timestamp there - YMMV). This should do fine, if you don't really need to look a the actual values.

/kristian

0 Karma

Path Finder

doesn't do what I need, it just returns 1 or 0 depending if there are any tasks in the transaction

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!