Splunk Search

Stats by custom string

dv2323
Explorer

I'd like to display stats based on a custom string within a log entry.  Below is sample of the log entry.  I'd like to parse the unique entries seen after "The following DAP records were selected for this connection:" string.  If possible use the stats by .... method so it displays a unique entry with the amount of times it's been seen.   So in the case of the 2 entries below, the stats would have TEST_AUTOMATION_VENDOR, and TEST2_AUTOMATION_VENDOR with a count next to it. I can do this for VPN users quite easily, but can't figure out how to do it for unique results of a string.   I only know the basics of splunk search syntax so hopefully I'm explaining this clearly.

 

%ASA-dap-6-734001: DAP: User TESTUSER, Addr 10.10.10.10, Connection AnyConnect: The following DAP records were selected for this connection: TEST_AUTOMATION_VENDOR

%ASA-dap-6-734001: DAP: User TESTUSER2, Addr 12.12.12.12, Connection AnyConnect: The following DAP records were selected for this connection: TEST2_AUTOMATION_VENDOR

Labels (4)
0 Karma
1 Solution

livehybrid
Super Champion

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits..

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+)
| stats count by dap_record

Let me know how you get on! Fingers crossed!

Will

View solution in original post

0 Karma

livehybrid
Super Champion

Hi @dv2323 You can use the rex command to extract the DAP record and then use stats, something like this:

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[A-Z_]+)"
| stats count by dap_record

I hope this helps!  

dv2323
Explorer

Thank you that is very close to what I'm looking for!  It's working, however it's only giving me partial names, and single Letter results.  I'm thinking maybe the regex piece of [A-Z_]+ needs to be adjusted to include an entire dap record?

0 Karma

livehybrid
Super Champion

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits..

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+)
| stats count by dap_record

Let me know how you get on! Fingers crossed!

Will

0 Karma

dv2323
Explorer

This works well.  Gives me just the full DAP name, and count.  Thank you.

0 Karma

rbar16
Explorer

@dv2323 Replace [A-Z_]+ with ".+" or ".*". You can also add an anchor "$" for end of line after the cap group if desired.

(?<dap_record>.+)$

dv2323
Explorer

This works well.  Thank you.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...