Splunk Search

How do I get all the values.

chappe4
New Member

I have tried this

source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex "(?<myword>EXP|Q up|X listing)" | stats count by myword

But I get the result

Myword          Count
EXP             23
X listing       55

How do I get all the three results? And also get a pie chart or it?
//Chappe4

Tags (1)
0 Karma

chappe4
New Member

Thanks the solution did work.

0 Karma

Ayn
Legend

Awesome. Could you please mark my answer as accepted? Thanks!

0 Karma

Ayn
Legend

If you're not seeing "Q up" in your stats table, that's either because it wasn't found in any of the events, or more likely because the events with the text "Q up" also contains one or more of the other values in your regex. By default rex will only match one time per event, so if you have an event with this text:

blabla EXP blabla Q up blablabla

rex will only extract "EXP" into your myword field. To have it match more than once, use the argument max_match which controls how many times rex is allowed to match within an event (default is, obviously, 1).

So for instance to allow rex to match 3 times, your search would be modified like this:

source=/var/log/testlog "EXP" OR "Q up" OR "X listing" | rex max_match=3 "(?<myword>EXP|Q up|X listing)" | stats count by myword

This should yield the results you're looking for. To get a pie chart of it, if you're in the search app, click the "Build report" link to the right, choose "pie" as the chart type and apply.

alanwds
Engager

This work for me.

Thank you very much!

0 Karma