Splunk Search

Search for a string that occurs more than once

c799651
Explorer

I'm trying to search for a string that occurs more than once. But the string contains wildcards and commas.

Which query will find if the following string occurs more than once ?

"BLOCK,%,%,1"

Where the % is a wildcard. (it is always an integer)

Tags (1)
0 Karma

493669
Super Champion

Try below-

|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0

below is using sample data-

|makeresults|eval _raw ="BLOCK,1,2,1
BLOCK,2,1,1"
|append[|makeresults|eval _raw ="BLOCK,1,2,1"]
|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0
0 Karma

c799651
Explorer

Thanks. This will find all events that contain a sting matching this critrea.

I was unclear in my question. I would also like find events that match this string more than once .

I may have 1000 records, 997 that contain this string once and 3 conatin this sting more than once. I want to find the 3 records with the sting more than once.

Thanks again

0 Karma

to4kawa
Ultra Champion
index=yours TERM("BLOCK")
| regex "BLOCK,\d*,d*,1"
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>