Splunk Search

Get pattern count in a log line

lain179
Communicator

Hi,

I have log lines that looks like this

Fetching documents "FileName1.doc", "FileName2.xls", "FileName10.jpg", FileName342.docx" <ProcessID>

My goal is to find how many file names there are per ProcessID, given that each name is quoted and separated by a comma and a space. How can I accomplish that?

Thanks!

Tags (1)
0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

If the file names are bound by the phrase "Fetching Documents" and the "<ProcessID>", then capturing the names, converting to a list and then enumerating the items in that list will do.

At search time you can catch the data with a runtime extraction:

sourcetype="answers-1371175757" | rex field=_raw "Fetching\sdocuments\s(?<FileNames>.+?)\s+\<(?<ProcessID>.+?)\>" | table FileNames ProcessID

There are, of course, multiple ways of doing that efficiently and you can always improve on that method. This will render something like this:

alt text

Instead of a table use makemv to convert the field to a list -ensure you delimit the members of the list by a comma.

| makemv delim="," FileNames

At this point, enumerate using stats:

 | stats count(FileNames) AS count by ProcessID

All together, it should look something like this:

sourcetype="answers-1371175757" | rex field=_raw "Fetching\sdocuments\s(?<FileNames>.+?)\s+\<(?<ProcessID>.+?)\>" | makemv delim="," FileNames | stats count(FileNames) AS count by ProcessID

And, it should produce something like this:

alt text


gc

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...