Splunk Search

multi pattern string calculation on fields

sumitnagal
Path Finder

I have log coming in this format. this value is dynamic and keep changing in terms of Form and numbers
Counts=[100A=0,100B=1,100C=2,100D=1,100E=3]

I want to first calculate how many form I have collected in this example
FormCount=5

I want to calculate Total Form calculated
FormTotal=7

Please let me know

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Append this to your search:

...  | rex "Counts=\[(?<Counts>[^\]]+)\]" | eval Counts = replace(Counts, "\w+=", "") | makemv Counts delim="," | eval FormCount = mvcount(Counts) | streamstats count as eventnum | eventstats sum(Counts) as FormTotal by eventnum
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...