I have a raw entries like this:
[08/14/12 09:58:55] SNMP INFO request received from 10.25.6.227 with unknown community string cable-d
the word after "string" varies form log to log.
I want to search something like this
... | chart count(word_after_"string") by host,word_after_string
How can I do that?
Reggards
You need to do a field extraction. Best choice is probably the rex command, though if you do this frequently you probably want to make it an automatic extraction in props.conf
... | rex field=_raw "string\w+(?<word_after_string>.*)$" | chart count by host, word_after_string
That should get you started, more details at:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex
... | rex "unknown community string (?<community_string>\S+)" | chart count by host,community_string