Splunk Search

where in stats command

Janani_Krish
Path Finder

Hello everyone,

I have my fields like below,

indicatortags
indicator 1tag 1,class:234
indicator 2tagg,class:456

I have to group my fields based on tags starting with class, and my query is like below,

sourcetype="my-data" |stats count by tags|where tags="class*"

But I am getting 0 results, as where class is taking only exact values and not "class*"

I want my result as below,

class:234 1

class:456 1

Kindly suggest.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
Legend

The problem with made up data is it can be difficult to give a useful answer.

  • Is tags a single field?
  • Is class always followed by a colon and 3 numbers?
  • Is class always at the end if the tags string?

However, given the example, try

sourcetype="my-data" 
| rex field=tags "(?<class>class:\d+)"
| stats count by class

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try

|where tags like "%class%"

Janani_Krish
Path Finder

Thanks @renjith_nair  this works. But If I am using this with timechart it is not working.

sourcetype="my-data" |timechart span=4h count by tags|where tags like "%class%"

Can you suggest.

0 Karma

ITWhisperer
Legend

The problem with made up data is it can be difficult to give a useful answer.

  • Is tags a single field?
  • Is class always followed by a colon and 3 numbers?
  • Is class always at the end if the tags string?

However, given the example, try

sourcetype="my-data" 
| rex field=tags "(?<class>class:\d+)"
| stats count by class

View solution in original post

Janani_Krish
Path Finder

Hi @ITWhisperer ,

Thanks for the reply,

1.No tags contain multiple fields or single field depending upon the log.

2.No class doesnt have any pattern.

3.No class can be anywhere in tags.

Rex command works well with timechart and stats command as well.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

if the structure of your tags is always "xxx,value" you could use a regex to extract the value after comma, something like this:

 

sourcetype="my-data" 
| stats count by tags
| rex field=tags "^[^,]*,(?<tags>.*)"
| search tags="class*"

 

Ciao.

Giuseppe

0 Karma

Janani_Krish
Path Finder

Hi @gcusello ,

Thank you for the suggestion. But my structure varies,,it is not always followed by comma.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

You should try (if possible) to identify all the rules of your tags field and write all the possible regexes to extract the tags you want.

There'a also anothe choice, if the list of tags isn't lo long and it's manageable, you could put the tags in a lookup and use this lookup to match the events with a tag.

Ciao.

Giuseppe

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!