Splunk Search group by parameter

[zservati]

I am trying to perform a search and using regx and parameter can summarize the result based on two categories which are filing-type and application ( see in bold below). My data looks as listed below for each filing record I have one event in the raw data now I need to get a count for each filing-type and application and the result output should be:

Filing-type Application Count
IRS-941-Payment QUICKBOOKS-DIY 1
SSA-W3-FILING QUICKBOOKS-DIY 1

The basic search perform to get the results below is :

index=efepr Filing was routed from FILING-PROCESSOR RECEIVED

==== Search result

1639] - Filing # 43221772, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {IRS-941-PAYMENT, IRS, QUICKBOOKS-DIY, Y:2012 W:5, RECEIVED}

1539] - Filing # 43221752, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {SSA-W3-FILING, IRS, QUICKBOOKS-DIY, Y:2011 M:1, RECEIVED}

[hexx]

Update: Now with in-line field extractions.

Provided that you have successfully extracted the fields "filing-type" (note that Splunk will flatten the dash in that field name to an underscore) and "application", it seems that you are looking for a search like this one :

index=efepr <additional search terms> | rex "\{(?<filing_type>[^,]*?),(?<filing_recipient>[^,]*?),(?<application>[^,]*?),(?<filing_date>[^,]*?),(?<filing_status>[^\}]*?)\}" | stats count by filing_type, application

[zservati]

What listed below is the result of the search basically we log this for each filing. Below is a sample what the search returns for two filing records.

1639] - Filing # 43221772, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {IRS-941-PAYMENT, IRS, QUICKBOOKS-DIY, Y:2012 W:5, RECEIVED}

1539] - Filing # 43221752, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {SSA-W3-FILING, IRS, QUICKBOOKS-DIY, Y:2011 M:1, RECEIVED}

[hexx]

To help you with that, we'll need to see a couple of sample events.

[zservati]

Extracting Filing Type and Application is what I'm struggling for so could you please let me know how I can extract these fields and assign it to two parameters Filing_type and Application, which then as you pointed out I can use stats to group them.