Regex Help in splunk 6.1.3

[pavanae]

The following were the different strings visible in my splunk search results…

"SYSTEM_USE_CD" : "C"
"SYSTEM_RSP_CD" : "0100"
"SYSTEM_STAT_CD" : "ACCEPT"

Now with the help of regex in my search string i want to display only these values and also want to see their stats count for these three of them like

system_cd Count

"SYSTEM_USE_CD" : "C" (some count)
"SYSTEM_RSP_CD" : "0100" (some count)

"SYSTEM_STAT_CD" : "ACCEPT" (some count)

Please help me how to display these stats from a splunk search with the help of regex

[alacercogitatus · Accepted solution]

You could do something like this:

<your_search> | rex field=_raw "SYSTEM_(?<system_cd>[^_]+)_CD.\s*:\s*\"(?<system_cd_value>[^\"]+)" | stats count by system_cd system_cd_value

You will probably also want to auto-extract these as well, it will keep your searches clean.

[pavanae]

Worked Great Thanks..

[echalex]

Hi,

Can you post some sample lines? It is not completely clear from the context what sort of regex would do the trick.