Splunk Search regex

[avsplunkuser007]

Hello, 

My first post!!!

I have a bunch of results that show up when searched. One of the example is 

Aug 5 19:08:12 ServerName Aug 5, 2020 19:08:12 GMT|50000|APP|UNKNOWN|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|443|XXXXX|-|/someprocess.php|-|A message posted successfully|500 

Aug 5 19:08:10 ServerName Aug 5, 2020 19:08:10 GMT|50000|APP|UNKNOWN|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|XXX.XXX.XXX.XXX|443|XXXXX|-|/newprocess.php|-|A message posted successfully|200

I want to do a stats count by the .php processes. So, how do i add these or eval/stats these .php processes / scripts ? 

[Anam]

Welcome to Splunk Answers! avesplunkuser007 We have some awesome contributors who help out users actively. Feel free to message me if you have any questions or concerns.

[thambisetty]

The events look like very much structured and values are delimited with pipe symbol.

you can use IFX(Interactive Field Extraction) to extract them very nicely.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/ExtractfieldsinteractivelywithIFX

[isoutamo]

And adding more Splunk features here, you could do this with props.conf and transforms.conf on search heads on search time ,-)

All these suggestions  will work, it's your chose to select which own is best for your current needs.

r. Ismo

[richgalloway]

Welcome!

To do stats on the field you first need to extract it.  The rex command does that.

index=foo
| rex "\/(?<file>\w+\.\w+)"
| stats count by file

[ITWhisperer]

It looks like the script name is the 11th field assuming "|" is the delimiter so something like this might work

... base search ...
| eval logmessage=_raw
| makemv delim="|" logmessage
| eval script=mvindex(logmessage,10)
| stats count by script

Indexes start at zero so index 10 for the 11th field