Splunk Search

count rex output within one line?

Path Finder

if I'm want to use a rex to pull out values at want to use the ?<xcount> psuedo-field to use in a chart, is this possible:

so Select * from xxx where id in (1,3,4,xxx,54..).. i want a field that gets me a count of the values in the IN clause there.

Is this even possible?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

It is, but it's not really a very good way of using Splunk if that's your main purpose:

... | rex "\((?<id>[^\(\)]*)\)" | rex max_match=99999 field=id ",?(<v>[^,]*),?" | eval c=mvcount(v)

Another way of doing this is:

... | eval c = len(replace(_raw,"[^,]","")) + 1

(or rex out the list first if there might be other commas in the _raw field, and I'm assuming the list can't be empty.)

It would be a lot better if you perhaps described to us where the source data originally comes from and whether there's a better way to get your result. It is also sometimes useful if you let us know what you are going to do with this count, in case the ultimate result is easier or better than simply counting

View solution in original post

Splunk Employee
Splunk Employee

It is, but it's not really a very good way of using Splunk if that's your main purpose:

... | rex "\((?<id>[^\(\)]*)\)" | rex max_match=99999 field=id ",?(<v>[^,]*),?" | eval c=mvcount(v)

Another way of doing this is:

... | eval c = len(replace(_raw,"[^,]","")) + 1

(or rex out the list first if there might be other commas in the _raw field, and I'm assuming the list can't be empty.)

It would be a lot better if you perhaps described to us where the source data originally comes from and whether there's a better way to get your result. It is also sometimes useful if you let us know what you are going to do with this count, in case the ultimate result is easier or better than simply counting

View solution in original post

Splunk Employee
Splunk Employee

The two examples I gave are intended to do that.

0 Karma

Path Finder

Sorry, we actually fixed this problem by having them add logging.. but here was the problem.. there is a SQL statement in the log with a Select blah in (x, y, z)... I needed the COUNT of items in the IN clause (in the parens).

0 Karma

Splunk Employee
Splunk Employee

I don't quite understand the question. Could you give a line or two of data (either raw or in tabular form) as well as the answer you want to get?

0 Karma