Splunk Search

Need to shorten data and show it by count

sunnyparmar
Communicator

Hi All,

I am executing query which is giving me the below result and I want to shorten the data and show in table format by total no. of count count. So what I want in table from the below result that is "code=200", "method=GET" and "SENDID=OSUUSPANKKI". Any insight would be appreciable. Thanks in advance

2017-12-18 07:26:50,357 [bwReqId=] [play-akka.actor.default-dispatcher-68163] [INFO ] [application] front-play - time=3ms code=200 method=GET remote_ip=85.76.XX.XX host=XXX.basware.com uri=/invoices/attachment/8fc60422e0de11e792e8f398?VERSION=0001&PMTREFNB=f171abc1-eef1-4cb3-a537-54ae4d638a65&TIMESTMP=2017-12-18-092641%2B02&KEYVERS=0001&ALG=0001&LANGCODE=1&SESSIONID=dGpohCr1yQJe-iKenar-&STATUS=Prod&SENDID=OSUUSPANKKI&PMTORIG=1&USERMAC=4901FF5EC300D405133A757F7FA0245B&MAC=B82F0BEECA1B8680CFD9889A94248EC9

0 Karma
1 Solution

andrey2007
Contributor

Hi, try this
[your search]

| rex field=_raw "^(?:[^=\n]*=){3}(?P<code>\d+)\s+\w+=(?P<method>[^ ]+)(?:[^&\n]*&){8}\w+=(?P<SENDID>\w+)" 

and if you need count
| stats count by method SENDID code

View solution in original post

andrey2007
Contributor

Hi, try this
[your search]

| rex field=_raw "^(?:[^=\n]*=){3}(?P<code>\d+)\s+\w+=(?P<method>[^ ]+)(?:[^&\n]*&){8}\w+=(?P<SENDID>\w+)" 

and if you need count
| stats count by method SENDID code

sunnyparmar
Communicator

Could you please let me know how you made this possible by rex as I have tried also but didn't get succeed. Thank you so much

0 Karma

andrey2007
Contributor

You can do it using drop-down menu clicking Event Actions=>Extract fields with Regex generator to generate regexp.

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...