Splunk Search

Stats by custom string

dv2323
Explorer

I'd like to display stats based on a custom string within a log entry.  Below is sample of the log entry.  I'd like to parse the unique entries seen after "The following DAP records were selected for this connection:" string.  If possible use the stats by .... method so it displays a unique entry with the amount of times it's been seen.   So in the case of the 2 entries below, the stats would have TEST_AUTOMATION_VENDOR, and TEST2_AUTOMATION_VENDOR with a count next to it. I can do this for VPN users quite easily, but can't figure out how to do it for unique results of a string.   I only know the basics of splunk search syntax so hopefully I'm explaining this clearly.

 

%ASA-dap-6-734001: DAP: User TESTUSER, Addr 10.10.10.10, Connection AnyConnect: The following DAP records were selected for this connection: TEST_AUTOMATION_VENDOR

%ASA-dap-6-734001: DAP: User TESTUSER2, Addr 12.12.12.12, Connection AnyConnect: The following DAP records were selected for this connection: TEST2_AUTOMATION_VENDOR

Labels (4)
0 Karma
1 Solution

livehybrid
Contributor

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits..

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+)
| stats count by dap_record

Let me know how you get on! Fingers crossed!

Will

View solution in original post

0 Karma

livehybrid
Contributor

Hi @dv2323 You can use the rex command to extract the DAP record and then use stats, something like this:

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[A-Z_]+)"
| stats count by dap_record

I hope this helps!  

dv2323
Explorer

Thank you that is very close to what I'm looking for!  It's working, however it's only giving me partial names, and single Letter results.  I'm thinking maybe the regex piece of [A-Z_]+ needs to be adjusted to include an entire dap record?

0 Karma

livehybrid
Contributor

Sorry yes, you could use a variety of different regexs depending on what the rest of your data looks like - I missed the numerical digits..

index=your_index sourcetype=your_sourcetype 
| rex field=_raw "The following DAP records were selected for this connection: (?<dap_record>[a-zA-Z0-9_]+)
| stats count by dap_record

Let me know how you get on! Fingers crossed!

Will

View solution in original post

0 Karma

dv2323
Explorer

This works well.  Gives me just the full DAP name, and count.  Thank you.

0 Karma

rbar16
Explorer

@dv2323 Replace [A-Z_]+ with ".+" or ".*". You can also add an anchor "$" for end of line after the cap group if desired.

(?<dap_record>.+)$

dv2323
Explorer

This works well.  Thank you.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!