Splunk Search

where in stats command

Janani_Krish
Path Finder

Hello everyone,

I have my fields like below,

indicatortags
indicator 1tag 1,class:234
indicator 2tagg,class:456

I have to group my fields based on tags starting with class, and my query is like below,

sourcetype="my-data" |stats count by tags|where tags="class*"

But I am getting 0 results, as where class is taking only exact values and not "class*"

I want my result as below,

class:234 1

class:456 1

Kindly suggest.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The problem with made up data is it can be difficult to give a useful answer.

  • Is tags a single field?
  • Is class always followed by a colon and 3 numbers?
  • Is class always at the end if the tags string?

However, given the example, try

sourcetype="my-data" 
| rex field=tags "(?<class>class:\d+)"
| stats count by class

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try

|where tags like "%class%"
Happy Splunking!

Janani_Krish
Path Finder

Thanks @renjith_nair  this works. But If I am using this with timechart it is not working.

sourcetype="my-data" |timechart span=4h count by tags|where tags like "%class%"

Can you suggest.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The problem with made up data is it can be difficult to give a useful answer.

  • Is tags a single field?
  • Is class always followed by a colon and 3 numbers?
  • Is class always at the end if the tags string?

However, given the example, try

sourcetype="my-data" 
| rex field=tags "(?<class>class:\d+)"
| stats count by class

Janani_Krish
Path Finder

Hi @ITWhisperer ,

Thanks for the reply,

1.No tags contain multiple fields or single field depending upon the log.

2.No class doesnt have any pattern.

3.No class can be anywhere in tags.

Rex command works well with timechart and stats command as well.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

if the structure of your tags is always "xxx,value" you could use a regex to extract the value after comma, something like this:

 

sourcetype="my-data" 
| stats count by tags
| rex field=tags "^[^,]*,(?<tags>.*)"
| search tags="class*"

 

Ciao.

Giuseppe

0 Karma

Janani_Krish
Path Finder

Hi @gcusello ,

Thank you for the suggestion. But my structure varies,,it is not always followed by comma.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Janani_Krish,

You should try (if possible) to identify all the rules of your tags field and write all the possible regexes to extract the tags you want.

There'a also anothe choice, if the list of tags isn't lo long and it's manageable, you could put the tags in a lookup and use this lookup to match the events with a tag.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...