tokenize on space and show only 1st part of starting

[avikc100]

I am getting result like this.

query:

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SmartIST.log" |stats count by SmartISTINTERFACE

instead of above I want a report like this:

[gcusello]

Hi @avikc100 ,

otherwise the solution from @ITWhisperer you could use the rex command:

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SmartIST.log" 
| rex field=SmartISTINTERFACE "^(?<SmartISTINTERFACE>[^ ]+)"
| stats count by SmartISTINTERFACE

Ciao.

Giuseppe

[gcusello]

Hi @avikc100 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ITWhisperer · Accepted solution]

Try something like this

index="webmethods_prd" host="USPGH-WMA2AISP*" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SmartIST.log" 
| eval Interface=mvindex(split(SmartISTINTERFACE," "),0)
|stats count by Interface