Splunk Search

Splunk table and regex filter

mnjmht18
New Member

I have following data in "log" field,
date1 name : message one
date2 name : message two
date3 name : message one
date4 name : message one
date5 name : message three
date6 name : message three

i want to filter this and create a table as below,
columns
log - count
message one - 3
message two - 1
message three - 2

how can i achieve this?

0 Karma

vnravikumar
Champion

Hi @mnjmht18

Try any one of the following

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| rex field=log "name :\s+(?P<log>[^:]+)$" 
| stats count by log

or

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| eval log= mvindex(split(log,"name :"),-1) 
| stats count by log
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this query.

... | rex field=log "name : (?<log>.*)"
| stats count by log
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...