Splunk Search

get substring from long raw string

tsek13
New Member

Hi guys, i am newbie in Splunk and i have the following indexed line:

Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO  | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]

How can I do this:
- get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw
- put the string x.y|.z.k... in new field (a =x.y|...)
- Remove duplicate values
- count all distinct strings
- generate chart or timechart or an hitmap with number of distinct strings

Thanhs for all your suport

0 Karma
1 Solution

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

View solution in original post

0 Karma

tsek13
New Member

Many thanks Iguinn!
Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!

0 Karma

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...