Splunk Search

get substring from long raw string

tsek13
New Member

Hi guys, i am newbie in Splunk and i have the following indexed line:

Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO  | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]

How can I do this:
- get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw
- put the string x.y|.z.k... in new field (a =x.y|...)
- Remove duplicate values
- count all distinct strings
- generate chart or timechart or an hitmap with number of distinct strings

Thanhs for all your suport

0 Karma
1 Solution

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

View solution in original post

0 Karma

tsek13
New Member

Many thanks Iguinn!
Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!

0 Karma

lguinn2
Legend

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...