Splunk Search

How to make whole Statement as a field?

jw44250
New Member

I have a search base like below and want to put the count as 1.

index=index1 test machine is not responding java.lang.NullPointerException as "test" | stats  count by test | dedup test

My count is 0

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The stats commands works upon the fields. Assuming whatever string you've on base search you want to show count of it, Try one of following methods.

index=index1 test machine is not responding java.lang.NullPointerException | stats count  | eval test="test machine is not responding java.lang.NullPointerException " | table test count

OR

 index=index1 test machine is not responding java.lang.NullPointerException | rex "(?<test>test machine is not responding java.lang.NullPointerException)"  | stats count by test
0 Karma

jw44250
New Member

Thanks. let me try it.

can i do soemthing like this, it works but not gettign any result
index=index1 test machine is not responding java.lang.NullPointerException as "testmachine" | stats count by testmachine

0 Karma

somesoni2
SplunkTrust
SplunkTrust

No you can't. YOu can't assign a field name to a string. You would need to have it extracted (like option 2) before you could use it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...