Splunk Search

get substring from long raw string

tsek13
New Member

Hi guys, i am newbie in Splunk and i have the following indexed line:

Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO  | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]

How can I do this:
- get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw
- put the string x.y|.z.k... in new field (a =x.y|...)
- Remove duplicate values
- count all distinct strings
- generate chart or timechart or an hitmap with number of distinct strings

Thanhs for all your suport

0 Karma
1 Solution

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

View solution in original post

0 Karma

tsek13
New Member

Many thanks Iguinn!
Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!

0 Karma

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...