Splunk Search

Filter out results from report using "rex _raw" and "stats count(eval(match(AA,""))) AS "ABC"" and filter out results with "count=0"

srishtiarora
New Member

Hi,

I am looking to filter out the contents of Search results that is using rex, transpose and count.
we are having multiple results with count 0 and need to be removed from report as its occupying majority of dashboard.

Below is Command sample:

table  "_raw"  | rex  field=_raw "(?PCode1)"  | rex  field=_raw "(?PCode2)" | rex  field=_raw " (?PCode3) " | stats  count(eval(match(AA,"")))  AS "Message1",  count(eval(match(AB,".*"))) AS "Message2" ,  count(eval(match(AC,".*"))) AS "Message3" |transpose

i am not sure how i can filter out this as where count>0 is not working.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Firstly, to ensure the whole search/code/result that you add in your question is completely shown, you should select the query/code/result part and press Ctrl +K OR click on "101 100" button on top of the text box.

Please ensure that you confirm the rex portions and try this.

...your base search | table "_raw" | rex field=_raw "(?P<AA>Code1)" | rex field=_raw "(?P<AB>Code2)" | rex field=_raw " (?P<AC>Code3) " | stats count(eval(match(AA,""))) AS "Message1", count(eval(match(AB,"."))) AS "Message2" , count(eval(match(AC,"."))) AS "Message3" | eval temp=1 | untable temp Message Count | where count>0 | fields - temp

If an event only contains one Code (a row will have only one of AA, AB or AC, then try this version

...your base search | table "_raw" | rex field=_raw "(?P<Message>(Code1|Code2|Code3))" | stats count by Message | where count>0 
0 Karma

srishtiarora
New Member

The Code 1 to Code 3 and Message1 to message3 are just aliases as it cannot be shared, but they hold different values and there is no string with Message in them.
when I tried adding eval temp=1 | untable temp Message Count | where count>0 | fields - temp, it didn't work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...