Splunk Search

Obtain a count of hits in a query of regexes

Path Finder

I am searching for a list of regexes in a splunk alert like this:

... | regex "regex1|regex2|...regexn"

Can I modify this query to get a table of the regexes found along with their count. The table shouldn't show rows with 0 counts.

regex2 17
regexn 3
0 Karma
1 Solution

SplunkTrust
SplunkTrust
 ... | regex "regex1|regex2|...regexn"
| rex  max_match=0 "(?<countfields>regex1|regex2|...regexn)"
| stats count by countfields

View solution in original post

SplunkTrust
SplunkTrust
 ... | regex "regex1|regex2|...regexn"
| rex  max_match=0 "(?<countfields>regex1|regex2|...regexn)"
| stats count by countfields

View solution in original post

Path Finder

Great answer @to4kawa.

Looks like | regex line is not needed. This is working for me. Notice the extra brackets.

| rex max_match=0 "(?P<countfields>((regex1)|(regex2)|..|(regexn)))"
| stats count by countfields
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!