Splunk Search

multi pattern string calculation on fields

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=0,100B=1,100C=2,100D=1,100E=3]

I want to first calculate how many form I have collected in this example
FormCount=5

I want to calculate Total Form calculated
FormTotal=7

Please let me know

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

...  | rex "Counts=\[(?<Counts>[^\]]+)\]" | eval Counts = replace(Counts, "\w+=", "") | makemv Counts delim="," | eval FormCount = mvcount(Counts) | streamstats count as eventnum | eventstats sum(Counts) as FormTotal by eventnum
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...