Splunk Search

Need to get the count of number of times a field is used in a request

ndayanat
Explorer

Need to get the count of number of times a field is used in a request

    Ex log:
    (This is a XML log, giving details from the middle and not the entire log)

Event 1: 
<students>
<student name="Raja" age="13" class="6" />
<student name="Nar" age="15" class'"8" />
<student name="Mag" age="16" class="7" />
</students>

Event 2:
<students>
<student name="Rex" age="13" class="6" />
<student name="Nanny" age="15" class'"8" />
</students>

I need to check how many times the field "Name" is used. As you can see the count varies for each event. How do I get that count?

Tags (1)
0 Karma
1 Solution

sundareshr
Legend

Try this

| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences

View solution in original post

sundareshr
Legend

Try this

| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences

ndayanat
Explorer

Sundareshr, Thank you for that. Can you please explain the rex and mvcount used above.

I also have one more doubt and will be more pleased if you clear that as well.
Take the Event1 from the above example. If I am filtering that alone and viewing it in splunk. Then the interesting fields has a field "name". My understanding was that it should display all the name's mentioned in the event. But it only displays the first name. for the above example it only displays Raja.

Is my understanding wrong?

0 Karma

sundareshr
Legend

rex is SPL's regular expression command. I used that to extract all occurrences of the word "name" in an event. I used max_match switch to create a multi-value field with as many matches as rex finds

https://regex101.com/r/sX8wD1/1

mvcount is for counting values within multi-value fields. Here's more on that

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Parsemultivaluefields#Evaluate_multivalue_f...

By default, field extraction will extract one occurrence. To get more than one, you either use rex with max_match or add MV_ADD in your transforms extraction. More on that here

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

0 Karma

ndayanat
Explorer

This was really helpful. But i have one more doubt here, we have used mvcount to get the count of that field, in case if I want to display the values for that field, what function do we use?

Ex: In event 1, there is a field called name, and if I check the values it only displays the first name of each event. ie Raja(from event 1) and Rex(from event 2). However, i want to display all the names in this field name.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...