How to write a search to count the number of times a string appears in a log file, including duplicates in a single event?

[Perant]

Using Splunk for the first time, having trouble describing this issue properly so I'm sure (hoping?) there's an easy answer and I'm just missing it, but I'm not sure if I can accomplish this from a search.

I'm looking to count the number of times a single string appears in a log file to count how many times an endpoint has been reached. The search I'm using is:

index="myIndex" "Entered method XYZ" | chart count by host

Where "Entered method XYZ" is a line output in the log file every time we reach this method. When I grep this string in the log file I might come up with 600 results, but running that search in Splunk only gives me around 500. In the events I can see that sometimes the string shows up twice in one event when it just so happens that two requests reach the server within some amount of lines of one another.

Is there any way I can specify in the search to treat each string as a separate event?

Thanks!

[randymoore]

Try this

index=myindex "Entered method XYZ" 
| rex max_match=0 "(?P<Method>Entered method XYZ*)" 
| eval count=mvcount(Method) 
| stats sum(count) as Total by host

[Perant]

Thanks for the suggestion, I've tried some similar queries to this but the result is the same. So when I run this query as you suggested, the Total for one particular host comes out to 359, but if I go and simply grep the string I come up with 439 matches. If I drill down into the results, I can see that the string I'm looking for is highlighted twice in one single event, and the count is the number of events, not the unique number of strings.

I'm still reading through the documentation here and I'm assuming the issue might be that I don't want events grouped up, I'd want them separated by line number. I've been searching around for a query that will return a unique number of strings but it always seems to count events like this.

[isoutamo]

That sound like your event breaking is not working like it should, if you have two real events in one splunk event!

[BasicLearner]

Hi, 

Even I am looking for a similar type of search.

Can you share the search query if you were successful.