Splunk Search

In Splunk how to find the number of words based on the a pipe separator and add a value to it and assign it to a new fil


Hi Have an event like this shown below

Today's Greeting Message=Hello|myname|name|is|Alice|myName|is|bob Good bye for today

The have a field name Message and its value is Hello|myname|name|is|Alice|myName|is|bob

How will I get the count of the words based on separator of a specific field value. And adding some new number to the count received and assign it to a new field value.

example for above log i will get 8 as count based on | separator(separator count+1).  Now i will add 2 to the count(8+2) and the value to be updated to a new splunk field.

This will help in calculating if any event that is crossing the threshold of that value then i can trigger an alert.

Some one please help me in getting this.

Labels (4)
0 Karma


You can count the words by using mvcount on the split field as below

| makeresults
| eval Message="Hello|myname|name|is|Alice|myName|is|bob"
| eval wordCount=mvcount(split(Message,"|"))

then you can do whatever you like to the wordCount, so in your example just add the two as part of the eval statement

| makeresults
| eval Message="Hello|myname|name|is|Alice|myName|is|bob"
| eval wordCount=mvcount(split(Message,"|"))+2

  Hope this helps

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...