Can Sum multiple | eval "@@@" as action1| eval "###" as action2 | eval "%%%" as action3 | stats count by user ?

[DavisXie]

Hello every one

host="abc"  user="12345678" | eval '"@@@" as action1| eval "###" as action2 | eval "$$$$" as actions2 | stats count by userID

There are 90 logline contains "@@@".

There are 90 logline contains "###".

There are 90 logline contains "$$$$".

All the "@@@" "### " "$$$$" are in the theRest field.

result
action1      90
action2     190
action3       3

Thank you all in advance.

[MuS]

Hi DavisXie,

not quiet sure what you want to do, but this is not the way eval works. If you want to use eval do something like this:

host="abc"  user="12345678" | eval action1=like(theRest, "created%") | eval action2=like(theRest, "submit%") | eval action3=like(theRest, "quit%") | stats count by user, action1, action2, action3

But usually if you want to get the actions from your events, you would get them into some field first and then do stuff with them. Try something like this:

host="abc"  user="12345678" | rex field=theRest "(?<action>(created)|(submit)|(quit))" | stats count by user, action

The rex field extraction can later be set as automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.1.4/Knowledge/Addfieldsatsearchtime

hope this helps ...

cheers, MuS

[MuS]

update ping

[DavisXie]

After copying the "There are 90 logline contains "###", forgot to edit the numbers.

Question
host="abc" user="12345678" | eval '"created" as action1| eval "submit" as action2 | eval "quit" as actions2 | stats count by userID

There are 90 logline contains "created".
There are 190 logline contains "submit".
There are 3 logline contains "quit".

All the "created" "submit" "quit" are in the theRest field.

result
action1 90
action2 190
action3 3