Splunk Search

how to search using subsearch of occurence of a value

VikashSharma47
Explorer

Hi Team,

I have a search query that searches for checking the busy tread and showing their occurrence in the log the value I need to print in the Splunk dashboard. We need printing bsy value beside the bsy like bsy 1,bsy 2 so we want to print those 1,2 value.

Attached the image for reference 

 

 

@scelikok @gcusello  and all Splunk enthusiastic please helptempsnip.png

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

I have a space in my rex expression which you don't appear to have. Perhaps being more explicit about the space might help

| rex "(?<bsy>bsy\s\d+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<bsy>bsy \d+)"
0 Karma

VikashSharma47
Explorer

Hi @ITWhisperer ,

I tried your given solution but it doesn't affect anything in the search. My ask is to fetch the result from the result. Actually, I need to print that bsy value which is beside it, and count for it. Attach the image for your reference. Anyway thanks a lot for looking into my queries.  The result shows here in the image as bsy 3 so I need that 3 value has to printed.

 

 

 

tempsnip.png 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have a space in my rex expression which you don't appear to have. Perhaps being more explicit about the space might help

| rex "(?<bsy>bsy\s\d+)"

VikashSharma47
Explorer

Thanks @ITWhisperer , It's working 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...