Splunk Search

Sub Search counts

SUNRAJ
Engager

I have filed called serial_id which have value ABC2022100845001 

I need count with contain 45  in last 5 & 6 th bytes 

Labels (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this:

Your base search | regex serial_id=".+45...$" | stats count

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this:

Your base search | regex serial_id=".+45...$" | stats count
0 Karma

SUNRAJ
Engager

yes it works-  if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?

Tags (1)
0 Karma

SUNRAJ
Engager

yes it works-  if i need another value in sub search and counts in table with distinct counts ??

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| rex field=serial_id ".+(?<marker>..)...$" 
| stats count by marker
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...