Splunk Search

Obtain a count of hits in a query of regexes

kimberlytrayson
Path Finder

I am searching for a list of regexes in a splunk alert like this:

... | regex "regex1|regex2|...regexn"

Can I modify this query to get a table of the regexes found along with their count. The table shouldn't show rows with 0 counts.

regex2 17
regexn 3
0 Karma
1 Solution

to4kawa
Ultra Champion
 ... | regex "regex1|regex2|...regexn"
| rex  max_match=0 "(?<countfields>regex1|regex2|...regexn)"
| stats count by countfields

View solution in original post

to4kawa
Ultra Champion
 ... | regex "regex1|regex2|...regexn"
| rex  max_match=0 "(?<countfields>regex1|regex2|...regexn)"
| stats count by countfields

kimberlytrayson
Path Finder

Great answer @to4kawa.

Looks like | regex line is not needed. This is working for me. Notice the extra brackets.

| rex max_match=0 "(?P<countfields>((regex1)|(regex2)|..|(regexn)))"
| stats count by countfields
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...