Splunk Search

how to eval new field to filter events by a number in the raw data

annamareddi
New Member

i want to filter my data, based on the key numbers present in raw events.
example
event1:
sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:123"jhdjdckl lcsdlkd

event2:
sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:134"jhdjdckl lcsdlkd

event3:
sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:1059"jhdjdckl lcsdlkd

event4:
sdfgn dfnlk 1/25/2017 ldjod djf lkd "iuhdfsadk sdkdljnkdl :key:1059"jhdjdckl lcsdlkd

i dont want repeated values, so i want the unique key values.

how to eval new field to filter this data by key values.

Tags (1)
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@annamareddi - Did the answer provided by jplumsdaine22 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

jplumsdaine22
Influencer

Do you mean that the field is not being extracted? You could use rex to create a new field:

... | rex ":key:(?<key>[^\"]+)"

and then you can use the field with stats etc. EG

... | rex ":key:(?<key>[^\"]+)" | stats count by key
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...