Searching and adding values in stats counter

[jhusum]

I have a logfile looking like this;

some long text at the start of the logline which, Read: 950 Imported: 800 Failed: 150, then some more text

I want to add counters for the three different values, read, imported and failed.

Can someone help me with this one?

[niketnilay]

While rex command in the search query will work, you should consider creating a field extraction so that the same regular expression need not to be written every time you need to fetch the same data from these events. Through field extractions the fields will be available at search time when you select specific index/sourcetype.

Splunk can automatically generates generic regular expression in the interactive mode. However, you can also provide your own regular expression (which would be same as what you run in rex command).

Interactive mode will allow allow you to review whether there are any unmatched events in the 1000 events listed by your search query. That way you test your regular expression across actual indexed data.

You can also use regex101 website to test your regular expression for some of your sample log snippets.

[chimell]

Hi jhusum

Try the following search code :

..............................   | rex  field=_raw  "Read:\s+(?<read>[0-9]+)\s+Imported:\s+(?<imported>[0-9]+)\s+Failed:\s+(?<failed>[0-9]+)"|stats dc(read) as read_count , dc(imported) as imported_count , dc(failed) as failed_count 

[maciep]

FYI, the more details you can provide in your question, the more attention/help you'll get. Can you share some of actual log data with us so we can see the actual events/entries? Nonetheless....

Is the data already in Splunk? If so, does something like this get you started?

index=[your index] sourcetype=[your sourcetype] | rex "Read:\s+(?<read>\d+) \s+Imported:\s+(?<imported>\d+)\s+Failed:\s+(?<failed>\d+)"

Does that create the fields you'd like to work with? Have a look at the rex command if you haven't used it before.