Splunk Search

count of character in field

Communicator

how would I count the number of occurances of a character or symbol in an extracted field and display that as a seperate field?

for instance counting the number fields passed in a POST message? (delimited by 😃

i have looked at rex, mvcount and stats but so far havent come up with a solution to do it from a search.

Any ideas?

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

there's probably more than way to do it with the eval command.

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Here's one, if you have a field called 'postPayload':

<your search> | eval numArgs = mvcount(split(postPayload,"="))-1

View solution in original post

Splunk Employee
Splunk Employee

How about something like this:

sourcetype=access_combined | eval chars=mvcount(split(uri, "=")) - 1 | table uri, chars
0 Karma

SplunkTrust
SplunkTrust

there's probably more than way to do it with the eval command.

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Here's one, if you have a field called 'postPayload':

<your search> | eval numArgs = mvcount(split(postPayload,"="))-1

View solution in original post