Need to get the count of number of times a field is used in a request
Ex log:
(This is a XML log, giving details from the middle and not the entire log)
Event 1:
<students>
<student name="Raja" age="13" class="6" />
<student name="Nar" age="15" class'"8" />
<student name="Mag" age="16" class="7" />
</students>
Event 2:
<students>
<student name="Rex" age="13" class="6" />
<student name="Nanny" age="15" class'"8" />
</students>
I need to check how many times the field "Name" is used. As you can see the count varies for each event. How do I get that count?
Try this
| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences
Try this
| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences
Sundareshr, Thank you for that. Can you please explain the rex and mvcount used above.
I also have one more doubt and will be more pleased if you clear that as well.
Take the Event1 from the above example. If I am filtering that alone and viewing it in splunk. Then the interesting fields has a field "name". My understanding was that it should display all the name's mentioned in the event. But it only displays the first name. for the above example it only displays Raja.
Is my understanding wrong?
rex
is SPL's regular expression command. I used that to extract all occurrences of the word "name" in an event. I used max_match
switch to create a multi-value field with as many matches as rex
finds
https://regex101.com/r/sX8wD1/1
mvcount
is for counting values within multi-value fields. Here's more on that
By default, field extraction will extract one occurrence. To get more than one, you either use rex
with max_match
or add MV_ADD
in your transforms extraction. More on that here
https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf
This was really helpful. But i have one more doubt here, we have used mvcount to get the count of that field, in case if I want to display the values for that field, what function do we use?
Ex: In event 1, there is a field called name, and if I check the values it only displays the first name of each event. ie Raja(from event 1) and Rex(from event 2). However, i want to display all the names in this field name.