This is a followup question to
http://splunk-base.splunk.com/answers/61123/how-can-i-search-in-logs-for-mutiple-vaules-from-a-file
I learnt from above post that below is the query to search for mutiple strings.
source=snmp [|inputlookup severity | fields sev | rename sev as search | format]
Now, say if "foo", "bar", "blah" are present one per line in the lookup file "severity" under field "sev"
I want output like below
String Count
foo 5
bar 0
blah 3
How can we achieve that ?
If I understand you correctly I did this in a rather inelegant way.
[your search] | rex field=sev "(?< f>foo)" | rex field=sev "(?<b>bar)" | rex field=sev "(?< bl>blah)" | eval strings=mvappend(f,NULL,b) | eval strings=mvappend(strings,NULL,bl) | mvexpand strings | stats count by strings
remove the spaces from the group names had to add them in to get it formating correctly. Hopefully someone can come up with something less awkward.
If I understand you correctly I did this in a rather inelegant way.
[your search] | rex field=sev "(?< f>foo)" | rex field=sev "(?<b>bar)" | rex field=sev "(?< bl>blah)" | eval strings=mvappend(f,NULL,b) | eval strings=mvappend(strings,NULL,bl) | mvexpand strings | stats count by strings
remove the spaces from the group names had to add them in to get it formating correctly. Hopefully someone can come up with something less awkward.