Rex/RegEx Question

[tkwaller]

Hello

I am trying to pull a text string out of some raw results using a simple regex. Heres my question: I would like to be able to get a stats count on the number of occurrances of this string. i would assume that you would have to put it into another field as it is simple text at the moment and not in a field. How would I do this? I am new to the rex/regex portion of Splunk and could use a little guidance.

Here is the raw data:

log_source=TT.WebService.Internal.OrderIntegration.OrderIntegration - Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange.
TT.Logic.TicketsNotFoundException: Exception of type 'TT.Logic.TicketsNotFoundException' was thrown.

I used \bUnable\b.* to get just the sentence "Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange."

I tried using "rex field=_raw...." and also creating a field named error like "rex field=error mode=sed" but am still not doing something correctly.

Any advice would be appreciated, thank you!

[martin_mueller]

In order to count events containing a certain string, try something like this:

index=foo sourcetype=bar "a certain string" | stats count

[tkwaller]

I am trying to count the number of events that contain this string

[martin_mueller]

Are you trying to count the number of events that contain a certain string, or are you trying to count the number of times a certain string appears in one event?

[lukejadamec · Accepted solution]

Try this:

search |rex ".*(?P<UnableCart>unable.*)" |table UnableCart

[tkwaller]

Getting closer. I think I can move forward from here through trial and error. Thanks so much for the guidance