Splunk Search

Rex/RegEx Question

tkwaller
Builder

Hello

I am trying to pull a text string out of some raw results using a simple regex. Heres my question: I would like to be able to get a stats count on the number of occurrances of this string. i would assume that you would have to put it into another field as it is simple text at the moment and not in a field. How would I do this? I am new to the rex/regex portion of Splunk and could use a little guidance.

Here is the raw data:

log_source=TT.WebService.Internal.OrderIntegration.OrderIntegration - Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange.
TT.Logic.TicketsNotFoundException: Exception of type 'TT.Logic.TicketsNotFoundException' was thrown.

I used \bUnable\b.* to get just the sentence "Unable to reserve shopping cart: Attempt to add tickets to the shopping cart resulted in a failure due to tickets no longer being on the exchange."

I tried using "rex field=_raw...." and also creating a field named error like "rex field=error mode=sed" but am still not doing something correctly.

Any advice would be appreciated, thank you!

Tags (1)
0 Karma
1 Solution

lukejadamec
Super Champion

Try this:

search |rex ".*(?P<UnableCart>unable.*)" |table UnableCart

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

In order to count events containing a certain string, try something like this:

index=foo sourcetype=bar "a certain string" | stats count
0 Karma

tkwaller
Builder

I am trying to count the number of events that contain this string

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you trying to count the number of events that contain a certain string, or are you trying to count the number of times a certain string appears in one event?

0 Karma

lukejadamec
Super Champion

Try this:

search |rex ".*(?P<UnableCart>unable.*)" |table UnableCart

tkwaller
Builder

Getting closer. I think I can move forward from here through trial and error. Thanks so much for the guidance

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...