Splunk Search

How to search and sort based on dynamic value?

batham
Explorer

Hi,

I am new to splunk and have a requirement where i have to search the logs which are on 100 servers and i have to figure if each log may consist 2 statements as below ex:

"started step1"

"started step2"

source of log contains actual name of source where i can check the step (location of log /test/test1/ABC.log ,/test/test1/CDE.log,/test/test1/DEF.log) which i figured out based on rex command (using regex) 

I want a table which contain for each log how many step are completed. like:

ABC      started step1  started step2

CDE    started step1

DEF    started step1 started step2

Labels (4)
0 Karma
1 Solution

batham
Explorer
0 Karma

batham
Explorer
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will help

index=foo ("started step1" OR "started step2")
```Extract the step into a field```
| rex "(?<step>started step\d)"
```Group the steps by reporting host```
| stats values(step) as steps by host
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...