Splunk Search

multi pattern string calculation on fields and count the fields value too

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=10,100B=1,100C=2,100D=1,100E=3,100A=20,100B=1,100C=2,100D=1,100E=3]

I want to calculate
100A=30
100B=2
100C=4
100D=2
100E=6

I have ask similar question where I have different requirements
http://answers.splunk.com/answers/185780/multi-pattern-string-calculation-on-fields.html

Tags (4)
0 Karma

bmacias84
Champion

I think you want to use extract(kv). This should give you fields for any dynamic range of files in the counts field

...| rex "Counts=\[(?<Counts>[^\]]+)\]" | field _time Counts|extract pairdelim=","  kvdelim="=" | fields _time 100* | stats count(*) as * by _time
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...