Splunk Search

count of character in field

EricPartington
Communicator

how would I count the number of occurances of a character or symbol in an extracted field and display that as a seperate field?

for instance counting the number fields passed in a POST message? (delimited by 😃

i have looked at rex, mvcount and stats but so far havent come up with a solution to do it from a search.

Any ideas?

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

there's probably more than way to do it with the eval command.

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Here's one, if you have a field called 'postPayload':

<your search> | eval numArgs = mvcount(split(postPayload,"="))-1

View solution in original post

mw
Splunk Employee
Splunk Employee

How about something like this:

sourcetype=access_combined | eval chars=mvcount(split(uri, "=")) - 1 | table uri, chars
0 Karma

sideview
SplunkTrust
SplunkTrust

there's probably more than way to do it with the eval command.

http://www.splunk.com/base/Documentation/latest/SearchReference/CommonEvalFunctions

Here's one, if you have a field called 'postPayload':

<your search> | eval numArgs = mvcount(split(postPayload,"="))-1
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...