count of the exact match

[prettysunshinez]

Hi,

I would want to have the count of a string (say "abcdef").
sometimes the string occurs multiple times in the same event.
But stats count by host is giving me the count of events where the string is present and not the count of string present inside an event also

Kindly help!

Thanks...

[kamlesh_vaghela]

@prettysunshinez

You can use rex command to get list of matching values in myVal field.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex

Please try this.

index=YourIndex  | rex max_match=0 field=_raw "(?<myVal>abcdef)" | eval count=mvcount(myVal)

Sample:

| makeresults | eval _raw="abcdef xgz mjjhj zkzkk abcdef" | rex max_match=0 field=_raw "(?<myVal>abcdef)" | eval count=mvcount(myVal)

Here abcdef is sample string.

Thanks