Splunk Search

Search for a string that occurs more than once


I'm trying to search for a string that occurs more than once. But the string contains wildcards and commas.

Which query will find if the following string occurs more than once ?


Where the % is a wildcard. (it is always an integer)

Tags (1)
0 Karma

Super Champion

Try below-

|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0

below is using sample data-

|makeresults|eval _raw ="BLOCK,1,2,1
|append[|makeresults|eval _raw ="BLOCK,1,2,1"]
|rex  max_match=0 "BLOCK,\d*,\d*,(?<block>\d)"|where mvcount(block)>0
0 Karma


Thanks. This will find all events that contain a sting matching this critrea.

I was unclear in my question. I would also like find events that match this string more than once .

I may have 1000 records, 997 that contain this string once and 3 conatin this sting more than once. I want to find the 3 records with the sting more than once.

Thanks again

0 Karma

Ultra Champion
index=yours TERM("BLOCK")
| regex "BLOCK,\d*,d*,1"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!