Splunk Search

multi pattern string calculation on fields and count the fields value too

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=10,100B=1,100C=2,100D=1,100E=3,100A=20,100B=1,100C=2,100D=1,100E=3]

I want to calculate
100A=30
100B=2
100C=4
100D=2
100E=6

I have ask similar question where I have different requirements
http://answers.splunk.com/answers/185780/multi-pattern-string-calculation-on-fields.html

Tags (4)
0 Karma

bmacias84
Champion

I think you want to use extract(kv). This should give you fields for any dynamic range of files in the counts field

...| rex "Counts=\[(?<Counts>[^\]]+)\]" | field _time Counts|extract pairdelim=","  kvdelim="=" | fields _time 100* | stats count(*) as * by _time
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...