Deployment Architecture

Some cost calculation by counting the number of characters per line and grouping

anil1432
Explorer
We want to work on some cost calculation by counting the number of characters per line and grouping the size per custom fields found in the line.

For example: this is 1 line

295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1- - message={"err":null,"count":1},service="ichiba",sessionId="95b480ec-bdcf-4b08-9af3-cfbfb8386a1d",processId="77e0d3ac-4d4c-4cca-9025-173c49660293"


1) Count the number of characters for this line
2) Set the count under non-field value GUID for this line is "5fcb6c91-6e9b-489a-8f55-6f60cbaa8175"
3) Get the total count per GUID

​I hope you can help us. Let me know if you need
Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Does this do what you want?

| makeresults
| eval _raw="295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={\"err\":null,\"count\":1},service=\"ichiba\",sessionId=\"95b480ec-bdcf-4b08-9af3-cfbfb8386a1d\",processId=\"77e0d3ac-4d4c-4cca-9025-173c49660293\""
| eval len=len(_raw)
| rex field=_raw "Member-Service-Support.pro.ichiba-chat-server-v\d+\s(?<guid>(\w+-?){5})"
| stats sum(len) as total_len by guid

the rex statement extracts the guid based on the regex, with the guid assumed to be found after the regex 

Member-Service-Support.pro.ichiba-chat-server-v\d+\s

hopefully this gives you what you want?

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Does this do what you want?

| makeresults
| eval _raw="295 <14>1 2021-06-02T02:41:30.349362+00:00 Member-Service-Support.pro.ichiba-chat-server-v2482 5fcb6c91-6e9b-489a-8f55-6f60cbaa8175 [APP/PROC/WEB/1] - - message={\"err\":null,\"count\":1},service=\"ichiba\",sessionId=\"95b480ec-bdcf-4b08-9af3-cfbfb8386a1d\",processId=\"77e0d3ac-4d4c-4cca-9025-173c49660293\""
| eval len=len(_raw)
| rex field=_raw "Member-Service-Support.pro.ichiba-chat-server-v\d+\s(?<guid>(\w+-?){5})"
| stats sum(len) as total_len by guid

the rex statement extracts the guid based on the regex, with the guid assumed to be found after the regex 

Member-Service-Support.pro.ichiba-chat-server-v\d+\s

hopefully this gives you what you want?

 

0 Karma

anil1432
Explorer

@bowesmana 

 

Thank you very much it's very helpful 😊😊🤘

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...