The following were my html search results
<country>USA</country>
<country>CANADA</country>
<country>UK</country>
<country>AUSTRALIA</country>
How do I write the regex to extract and list out the countries and their count.
Thanks
First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):
props.conf:
SHOULD_LINEMERGE=false
Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.
<...Initial Search...>|rex field=_raw "<country>(?< COUNTRY>.*)<\/country>"|stats count by COUNTRY as COUNTRY_COUNT
Assuming those are all in the same event...
| rex max_match=0 "\<country\>(?<country>[^\<]+)"
Reference: http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/rex
First, if the search results you mentioned are separate events, then you are good. Else, you need to add this config in the Parsing Stage (Heavy Forwarder/Indexer):
props.conf:
SHOULD_LINEMERGE=false
Post that, use this regex in the search query to extract the Amount Due field and then calculate the average.
<...Initial Search...>|rex field=_raw "<country>(?< COUNTRY>.*)<\/country>"|stats count by COUNTRY as COUNTRY_COUNT
Please use the code options while pasting the answer so that the page should not exclude characters such as "< "etc..
thanks badrinath! I edited my answer and now it is working fine.
Is every line a seperated event, or are all lines united in one event?