Splunk Search

How to get counts of events matching only particular value pattern from multi valued field

arrangineni
Path Finder

I am trying to get counts of events that match only a particular field value pattern from a multi-valued field.

Multi valued field values like:
name=abc;name=12345;name=246
name=12344
name=246;name=abc
name=12378

Need counts of events which only contains field values containing name=123* and ignore the once which are combination of others?

I did try the below but it includes all events containing name=123*
| makemv delim=";" multivalued-field
| rex field=multivalued-field "name=(?P[^,]+),"
| search whatineed="123*"

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="raw
name=abc;name=12345;name=246
name=12344
name=246;name=abc
name=12378
name=12378;name=12379" 
| multikv forceheader=1 
| rex max_match=0 "name=(?<name>[^;]+)" 
| rename COMMENT as "this is sample. form here, the logic" 
| table name 
| rename COMMENT as "please check this result" 
| eval names=mvmap(name,if(match(name,"^123"),1,0)) 
| streamstats window=1 sum(names) as sums 
| where mvcount(names) = sums 
| stats count
0 Karma

arrangineni
Path Finder

@to4kawa thanks for assisting, but using the above approach I am also getting the count for " name=abc;name=12345;name=246" which I don't need.

I am looking for counts which ONLY included values 123* and ignore other combinations. But combination of 123* and 123* is valid.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...