Splunk rex help

[chanukhya]

I am trying to count the number of 200 response codes from an access log. can you please help in getting me the output.

26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/A_node/A_Cluster_jvm 117 118 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" B_Cell/B_node/B_Cluster_jvm_2 164 819 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/C_node/C_Cluster_jvm_1197 917 200

Log looks like the above. Is it possible to get the output of stats count by each cell, node and and each jvm? I dont need reading the response codes, because i am doing "* * 200" in base search

[somesoni2 · Accepted solution]

Try like this

Updated based on new sample data

your base search | rex "^([^\"]+\"){2}\s+[^\/]+\/(?<node>[^\/]+)\/(?<jvm>\S+)\s+.+(?<response_code>\d+)$" | where response_code=200 | stats count by node jvm

[chanukhya]

Thanks for the response, I also have the date and time in the log. Your regex is picking up "Jan". I dont actually care about method or URI. I just need stats by cell, node and jvm.

[somesoni2]

Try the updated answer (original answer updated).

[chanukhya]

Thanks for the answer. Is there a tool or way to get or learn how to use these regex codes?

[somesoni2]

You can use following links:

https://answers.splunk.com/answers/79860/where-i-can-learn-regular-expressions-to-use-them-and-to-cr...

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/AboutSplunkregularexpressions

http://www.learnsplunk.com/splunk-regex-tutorial.html