Splunk Search

multi pattern string calculation on fields and count the fields value too

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=10,100B=1,100C=2,100D=1,100E=3,100A=20,100B=1,100C=2,100D=1,100E=3]

I want to calculate
100A=30
100B=2
100C=4
100D=2
100E=6

I have ask similar question where I have different requirements
http://answers.splunk.com/answers/185780/multi-pattern-string-calculation-on-fields.html

Tags (4)
0 Karma

bmacias84
Champion

I think you want to use extract(kv). This should give you fields for any dynamic range of files in the counts field

...| rex "Counts=\[(?<Counts>[^\]]+)\]" | field _time Counts|extract pairdelim=","  kvdelim="=" | fields _time 100* | stats count(*) as * by _time
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2026-2027 SplunkTrust is officially open. If ...