Splunk Search

multi pattern string calculation on fields and count the fields value too

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=10,100B=1,100C=2,100D=1,100E=3,100A=20,100B=1,100C=2,100D=1,100E=3]

I want to calculate
100A=30
100B=2
100C=4
100D=2
100E=6

I have ask similar question where I have different requirements
http://answers.splunk.com/answers/185780/multi-pattern-string-calculation-on-fields.html

Tags (4)
0 Karma

bmacias84
Champion

I think you want to use extract(kv). This should give you fields for any dynamic range of files in the counts field

...| rex "Counts=\[(?<Counts>[^\]]+)\]" | field _time Counts|extract pairdelim=","  kvdelim="=" | fields _time 100* | stats count(*) as * by _time
0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...