Splunk Search
Highlighted

Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

New Member

Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

edit: here's what I'm trying to do
ie, "eval myField=( "value1", "value2", "value3") | stats count by myField"

Where "value1", "value2", "value3" are literal strings.

I want to get a count for how many "value1"s, "value2"s, and "value3"s there are

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

SplunkTrust
SplunkTrust

Could you please post some sudo query on what you want to achieve, possible with some examples?

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

New Member

ie, "eval myField=( "value1", "value2", "value3") | stats count by myField"

Where "value1", "value2", "value3" are literal strings.

I want to get a count for how many "value1"s, "value2"s, and "value3"s there are

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

SplunkTrust
SplunkTrust

How are the values for string "value1", "value2"... coming, static/fix string or dynamically?

If they are static/fixed and limited, something like this would work.

...| eval myField=if(match(myField,"value1"),"value1", match(myField,"value2"),"value2", match(myField,"value3"),"value3") | stats count by myField

If they are move in number, you can put them in a lookup table file say myfield_value.csv with column name as myfieldvalue, and try like this

...| lookup myfield_value.csv myfieldvalue as myField OUTPUT myfieldvalue as myField  | stats count by myField
0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

Super Champion

Not quite clear from your question, but an example would be helpful.

But just a guess, are you looking for something like this ? https://answers.splunk.com/answers/103700/how-do-i-create-a-field-whose-name-is-the-value-of-another...

|makeresults| eval aKey="Field1" | eval aValue=123 | eval {aKey}=aValue | table aKey,aValue,Field1
0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

Esteemed Legend

Assuming that you are just matching strings in the raw events (the strings are not accessed by a field name), then like this:

Your Base Search Here | stats 
[| makeresults 
 | eval errorMsg="value1::value2::INFO" 
 | makemv delim="::" errorMsg
 | format "" "" "" "" "" "" 
 | rex field=search mode=sed "s/\( errorMsg=| OR errorMsg=/ count(eval(searchmatch(/g s/\" count\(/\")) count(/g s/\s*\)  $/))/ s/\"([^\"]+)\"\)\)/\"\1\"))) AS \"\1\"/g"]

If you do indeed have field names that contain these strings, then like this (you might have to change the field name errorMsg to your field name):

Your Base Search Here | stats 
[| makeresults 
| eval errorMsg="value1::value2::value2" 
| makemv delim="::" errorMsg 
| rex field=errorMsg mode=sed "s/[\r\n]//g"
| format "" "" "" "" "" "" 
| rex field=search mode=sed "s/\(| OR / count(eval(/g s/\" count\(/\")) count(/g s/\s*\)  $/))/ s/\"([^\"]+)\"\)\)/\"\1\")) AS \"\1\"/g"]

You can make this into a macro.

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

New Member

Now it throws the following error: Error in 'stats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field 'count(eval( errorMsg="at the below stack trace. Not closed in the same method"))'.

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

Esteemed Legend

Try replacing the last line with this:

| rex field=search mode=sed "s/\(| OR / count(eval(/g s/\" count\(/\")) count(/g s/\s*\)  $/))/ s/\"(\w+)\"\)\)/\"\1\")) AS \1/g"
0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

Esteemed Legend

Answer updated to account for spacing variances in format command.

0 Karma
Highlighted

Re: Is there a way to search for a list of strings, and for each match, put that string as the value of the same field?

New Member

Still throwing the same error

0 Karma