Splunk Search

How can i extract words and their count from a field summary in a table?

smruti13
Observer

I have a table which has fields defects and summary that gives me the summary of the defects. I want to extract some words from summary and their count as well. Please help.

0 Karma
1 Solution

dineshraj9
Builder

Considering you are only checking the issue_type and summary fields and you know the values you are looking for (i.e. words like Bug, Reopened etc.), you can do it this way -

<your search> | eval details=issue_type.summary | rex max_match=0 field=details "(?<word>(?i)(Bug|Reopened|Closed))" | stats count by word

View solution in original post

0 Karma

dineshraj9
Builder

Considering you are only checking the issue_type and summary fields and you know the values you are looking for (i.e. words like Bug, Reopened etc.), you can do it this way -

<your search> | eval details=issue_type.summary | rex max_match=0 field=details "(?<word>(?i)(Bug|Reopened|Closed))" | stats count by word
0 Karma

smruti13
Observer

Thanks Dinesh. It works fine . Modified the query a bit as i did not want it on issue_type field.Just summary would do it.

0 Karma

dineshraj9
Builder

Great!! 🙂

0 Karma

dineshraj9
Builder

Can you provide a sample of your data and the output you are expecting?

0 Karma

smruti13
Observer

sure .

my table:

key issue_type summary
SPJ-171 Bug Reopened n for aaam
SPJ-18 Bug Reopened_m for AAAM
SPJ-19 Bug Bug 2
SPJ-19 Bug Reopened x for aaam

expected (eg):

word count
Reopned 3
Bug 5 etc.

The words are from the summary field. Hope I am clear 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...