Splunk Search

Searching and adding values in stats counter

jhusum
Engager

I have a logfile looking like this;

some long text at the start of the logline which, Read: 950 Imported: 800 Failed: 150, then some more text

I want to add counters for the three different values, read, imported and failed.

Can someone help me with this one?

0 Karma

niketn
Legend

While rex command in the search query will work, you should consider creating a field extraction so that the same regular expression need not to be written every time you need to fetch the same data from these events. Through field extractions the fields will be available at search time when you select specific index/sourcetype.

Splunk can automatically generates generic regular expression in the interactive mode. However, you can also provide your own regular expression (which would be same as what you run in rex command).

Interactive mode will allow allow you to review whether there are any unmatched events in the 1000 events listed by your search query. That way you test your regular expression across actual indexed data.

You can also use regex101 website to test your regular expression for some of your sample log snippets.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

chimell
Motivator

Hi jhusum

Try the following search code :

..............................   | rex  field=_raw  "Read:\s+(?<read>[0-9]+)\s+Imported:\s+(?<imported>[0-9]+)\s+Failed:\s+(?<failed>[0-9]+)"|stats dc(read) as read_count , dc(imported) as imported_count , dc(failed) as failed_count 
0 Karma

maciep
Champion

FYI, the more details you can provide in your question, the more attention/help you'll get. Can you share some of actual log data with us so we can see the actual events/entries? Nonetheless....

Is the data already in Splunk? If so, does something like this get you started?

index=[your index] sourcetype=[your sourcetype] | rex "Read:\s+(?<read>\d+) \s+Imported:\s+(?<imported>\d+)\s+Failed:\s+(?<failed>\d+)"

Does that create the fields you'd like to work with? Have a look at the rex command if you haven't used it before.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...