Splunk Search

count rex output within one line?

mmattek
Path Finder

if I'm want to use a rex to pull out values at want to use the ?<xcount> psuedo-field to use in a chart, is this possible:

so Select * from xxx where id in (1,3,4,xxx,54..).. i want a field that gets me a count of the values in the IN clause there.

Is this even possible?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It is, but it's not really a very good way of using Splunk if that's your main purpose:

... | rex "\((?<id>[^\(\)]*)\)" | rex max_match=99999 field=id ",?(<v>[^,]*),?" | eval c=mvcount(v)

Another way of doing this is:

... | eval c = len(replace(_raw,"[^,]","")) + 1

(or rex out the list first if there might be other commas in the _raw field, and I'm assuming the list can't be empty.)

It would be a lot better if you perhaps described to us where the source data originally comes from and whether there's a better way to get your result. It is also sometimes useful if you let us know what you are going to do with this count, in case the ultimate result is easier or better than simply counting

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

It is, but it's not really a very good way of using Splunk if that's your main purpose:

... | rex "\((?<id>[^\(\)]*)\)" | rex max_match=99999 field=id ",?(<v>[^,]*),?" | eval c=mvcount(v)

Another way of doing this is:

... | eval c = len(replace(_raw,"[^,]","")) + 1

(or rex out the list first if there might be other commas in the _raw field, and I'm assuming the list can't be empty.)

It would be a lot better if you perhaps described to us where the source data originally comes from and whether there's a better way to get your result. It is also sometimes useful if you let us know what you are going to do with this count, in case the ultimate result is easier or better than simply counting

gkanapathy
Splunk Employee
Splunk Employee

The two examples I gave are intended to do that.

0 Karma

mmattek
Path Finder

Sorry, we actually fixed this problem by having them add logging.. but here was the problem.. there is a SQL statement in the log with a Select blah in (x, y, z)... I needed the COUNT of items in the IN clause (in the parens).

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

I don't quite understand the question. Could you give a line or two of data (either raw or in tabular form) as well as the answer you want to get?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...