I am trying to perform a search and using regx and parameter can summarize the result based on two categories which are filing-type and application ( see in bold below). My data looks as listed below for each filing record I have one event in the raw data now I need to get a count for each filing-type and application and the result output should be:
Filing-type Application Count
IRS-941-Payment QUICKBOOKS-DIY 1
SSA-W3-FILING QUICKBOOKS-DIY 1
The basic search perform to get the results below is :
index=efepr Filing was routed from FILING-PROCESSOR RECEIVED
==== Search result
1639] - Filing # 43221772, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {IRS-941-PAYMENT, IRS, QUICKBOOKS-DIY, Y:2012 W:5, RECEIVED}
1539] - Filing # 43221752, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {SSA-W3-FILING, IRS, QUICKBOOKS-DIY, Y:2011 M:1, RECEIVED}
Update: Now with in-line field extractions.
Provided that you have successfully extracted the fields "filing-type" (note that Splunk will flatten the dash in that field name to an underscore) and "application", it seems that you are looking for a search like this one :
index=efepr <additional search terms> | rex "\{(?<filing_type>[^,]*?),(?<filing_recipient>[^,]*?),(?<application>[^,]*?),(?<filing_date>[^,]*?),(?<filing_status>[^\}]*?)\}" | stats count by filing_type, application
What listed below is the result of the search basically we log this for each filing. Below is a sample what the search returns for two filing records.
1639] - Filing # 43221772, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {IRS-941-PAYMENT, IRS, QUICKBOOKS-DIY, Y:2012 W:5, RECEIVED}
1539] - Filing # 43221752, was routed from FILING-PROCESSOR to [queue/CONVERTER] with key {SSA-W3-FILING, IRS, QUICKBOOKS-DIY, Y:2011 M:1, RECEIVED}
To help you with that, we'll need to see a couple of sample events.
Extracting Filing Type and Application is what I'm struggling for so could you please let me know how I can extract these fields and assign it to two parameters Filing_type and Application, which then as you pointed out I can use stats to group them.