Splunk Search

Searching and adding values in stats counter

jhusum
Engager

I have a logfile looking like this;

some long text at the start of the logline which, Read: 950 Imported: 800 Failed: 150, then some more text

I want to add counters for the three different values, read, imported and failed.

Can someone help me with this one?

0 Karma

niketn
Legend

While rex command in the search query will work, you should consider creating a field extraction so that the same regular expression need not to be written every time you need to fetch the same data from these events. Through field extractions the fields will be available at search time when you select specific index/sourcetype.

Splunk can automatically generates generic regular expression in the interactive mode. However, you can also provide your own regular expression (which would be same as what you run in rex command).

Interactive mode will allow allow you to review whether there are any unmatched events in the 1000 events listed by your search query. That way you test your regular expression across actual indexed data.

You can also use regex101 website to test your regular expression for some of your sample log snippets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chimell
Motivator

Hi jhusum

Try the following search code :

..............................   | rex  field=_raw  "Read:\s+(?<read>[0-9]+)\s+Imported:\s+(?<imported>[0-9]+)\s+Failed:\s+(?<failed>[0-9]+)"|stats dc(read) as read_count , dc(imported) as imported_count , dc(failed) as failed_count 
0 Karma

maciep
Champion

FYI, the more details you can provide in your question, the more attention/help you'll get. Can you share some of actual log data with us so we can see the actual events/entries? Nonetheless....

Is the data already in Splunk? If so, does something like this get you started?

index=[your index] sourcetype=[your sourcetype] | rex "Read:\s+(?<read>\d+) \s+Imported:\s+(?<imported>\d+)\s+Failed:\s+(?<failed>\d+)"

Does that create the fields you'd like to work with? Have a look at the rex command if you haven't used it before.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...