Splunk Search

How to generate a search that counts specific strings that occur in _raw data?

riotto
Path Finder

I have raw data events that contain the words "Request" or "Response" or "Offer". Each event will contain only one of these strings, but it will maybe have the string several times in the event. I want to count the how many events contain "Offer" and how many events contain "Response" and how many events contain "Request"..this should be easy but I am struggling to get it right, any help will be appreciated

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your Base Search Here | stats count AS Total count(eval(searchmatch("Request"))) AS Requests count(eval(searchmatch("Response"))) AS Response count(eval(searchmatch("Offer"))) AS Offer

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Oh, you need to see at least three different ways to do this, so here's another...

If the words are always capitalized exactly as you had them...

your search here
| rex "(?<rectype>Request|Response|Offer)"
| stats count by rectype

...or if they might vary...

your search here
| rex "(i)(?<rectype>Request|Response|Offer)"
| eval rectype=lower(rectype)
| stats count by rectype

woodcock
Esteemed Legend

Like this:

Your Base Search Here | stats count AS Total count(eval(searchmatch("Request"))) AS Requests count(eval(searchmatch("Response"))) AS Response count(eval(searchmatch("Offer"))) AS Offer

riotto
Path Finder

This work great..Thanks

0 Karma

cmerriman
Super Champion

you could add in an eval like this:

|eval fieldCount=if(like(_raw,"%Request%") OR like(_raw,"%Response%") OR like(_raw,"%Offer%"),1,0)|stats sum(fieldCount) as total by eventIdentifier
0 Karma

riotto
Path Finder

Thank for the quick reply, but I need a count for each

ie. Responses=6
Request=10
Offer=25

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...