Hi guys, i am newbie in Splunk and i have the following indexed line:
Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]
How can I do this:
- get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw
- put the string x.y|.z.k... in new field (a =
x.y|...)
- Remove duplicate values
- count all distinct strings
- generate chart or timechart or an hitmap with number of distinct strings
Thanhs for all your suport
Try this:
yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString
or
yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)
Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?
Many thanks Iguinn!
Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!
Try this:
yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString
or
yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)
Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?