Splunk Search

How to write a Regex to extract and list out the country names from my html formatted results ?

Builder

The following were my html search results

<country>USA</country>
<country>CANADA</country>
<country>UK</country>
<country>AUSTRALIA</country>

How do I write the regex to extract and list out the countries and their count.

Thanks

0 Karma
1 Solution

Communicator

First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):

props.conf:
SHOULD_LINEMERGE=false

Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.

<...Initial Search...>|rex field=_raw "<country>(?< COUNTRY>.*)<\/country>"|stats count by COUNTRY as COUNTRY_COUNT

View solution in original post

Influencer

Assuming those are all in the same event...

| rex max_match=0 "\<country\>(?<country>[^\<]+)"

Reference: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/rex

0 Karma

Communicator

First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):

props.conf:
SHOULD_LINEMERGE=false

Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.

<...Initial Search...>|rex field=_raw "<country>(?< COUNTRY>.*)<\/country>"|stats count by COUNTRY as COUNTRY_COUNT

View solution in original post

Communicator

Please use the code options while pasting the answer so that the page should not exclude characters such as "< "etc..

Communicator

thanks badrinath! I edited my answer and now it is working fine.

0 Karma

Is every line a seperated event, or are all lines united in one event?

0 Karma