Splunk Search

Sub Search counts

SUNRAJ
Engager

I have filed called serial_id which have value ABC2022100845001 

I need count with contain 45  in last 5 & 6 th bytes 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this:

Your base search | regex serial_id=".+45...$" | stats count

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this:

Your base search | regex serial_id=".+45...$" | stats count

View solution in original post

0 Karma

SUNRAJ
Engager

yes it works-  if i need another value like 45 and 47 in sub search and counts in table with distinct counts ?

Tags (1)
0 Karma

SUNRAJ
Engager

yes it works-  if i need another value in sub search and counts in table with distinct counts ??

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
base search 
| rex field=serial_id ".+(?<marker>..)...$" 
| stats count by marker
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!