Splunk Search

Regex Money

rpascua
Explorer

My Regex:

| rex "\sof (?<Name>[A-Za-z0-9_]+)" | rex "\sdeposit \((?<Deposit>\d+)" | rex "\s*withdrawal \((?<Withdrawal>\d+)" | table Name Deposit Withdrawal | addtotals Withdrawal "\s*withdrawal \((?<Withdrawal>\d+)"

The problem:

If John took money out three times within a 24-hour period, using the REGEX above, I would have a 3-liner output like below...

John Deposit 0 Withdrawal 50 Total Withdrawal 50

John Deposit 0 Withdrawal 35 Total Withdrawal 35

John Deposit 0 Withdrawal 25 Total Withdrawal 25

But all I need is a one-liner like so:

John Deposit 0 Withdrawal 110 Total Withdrawal 110

I tried multiple combinations on that last line of code (addtotals) but keep coming up empty. Any assistance would be much appreciated.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're trying to calculate the sum of deposits and withdrawals per person? Append this:

... | stats sum(Deposit) sum(Withdrawal) by Name

View solution in original post

marcoscala
Builder

And remember that you can write a single "Rex" matching all the different fields you need to extract, if of course are ALL present in the same event...

Marco

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You're trying to calculate the sum of deposits and withdrawals per person? Append this:

... | stats sum(Deposit) sum(Withdrawal) by Name

rpascua
Explorer

Oh.. duh. It works! Thank you Splunk God!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That's what the by Name is for.

rpascua
Explorer

Yes, I tried "stats" as well. But instead of typing each name (ie. John, Stacey, Logan) I'm trying to parse out an entire list of names along with the number of withdrawals they made within the last 24 hours.

I'm trying to avoid doing this for each names:

John " withdrawal" | rex "\sof (?[A-Za-z0-9_]+)" | rex "\sdeposit ((?\d+)" | rex "\s*withdrawal ((?\d+)" | table Name Deposit Withdrawal | stats sum(Withdrawal)

Stacey " withdrawal" | rex "\sof (?[A-Za-z0-9_]+)" | rex ........ and so on

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...