Splunk Search

how to search using subsearch of occurence of a value

VikashSharma47
Explorer

Hi Team,

I have a search query that searches for checking the busy tread and showing their occurrence in the log the value I need to print in the Splunk dashboard. We need printing bsy value beside the bsy like bsy 1,bsy 2 so we want to print those 1,2 value.

Attached the image for reference 

 

 

@scelikok @gcusello  and all Splunk enthusiastic please helptempsnip.png

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

I have a space in my rex expression which you don't appear to have. Perhaps being more explicit about the space might help

| rex "(?<bsy>bsy\s\d+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<bsy>bsy \d+)"
0 Karma

VikashSharma47
Explorer

Hi @ITWhisperer ,

I tried your given solution but it doesn't affect anything in the search. My ask is to fetch the result from the result. Actually, I need to print that bsy value which is beside it, and count for it. Attach the image for your reference. Anyway thanks a lot for looking into my queries.  The result shows here in the image as bsy 3 so I need that 3 value has to printed.

 

 

 

tempsnip.png 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have a space in my rex expression which you don't appear to have. Perhaps being more explicit about the space might help

| rex "(?<bsy>bsy\s\d+)"

VikashSharma47
Explorer

Thanks @ITWhisperer , It's working 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...