基于正则表达式的splunk查询 [英] splunk query for counting based on regex

问题描述

我的示例日志如下所示

fixed message: 443-343-234-event-put
fixed message: wre-sdfsdf-234-event-keep-alive
fixed message: dg34-343-234-event-auth_revoked
fixed message: qqqq-sdf-234-event-put
fixed message: wre-r323-234-event-keep-alive
fixed message: we33-343-234-event-auth_revoked

日志模式为"fixed message: {UUID}-{event-type}"

我想记录总共有多少个事件；在事件输入，事件保持活动和事件授权撤消的数量中，

I would like to capture how many total events; out of those how many are event-put, event-keep-alive and event-auth_revoked

我是否可以通过不合条件的查询来捕获以上需求?

can I have splunk query to capture above needs ?

推荐答案

您可以使用

You can use rex to prototype a field extraction, so you can try it out first

rex "fixed message: (?P<UUID>\w+-\w+\w+)-(?P<event>.*)"

因此您可以执行以下操作:

So you can do this:

搜索字词 | rex "fixed message: (?P<UUID>[^-+]-[^-+]-[^-+])-(?P<event>.*)" | stats count by event

然后，您可以阅读文档它不需要在搜索中始终执行rex命令.因此，场提取是自动进行的.

Then you can read the documentation to make it where you don't need to always do the rex command with your searches. So the field extraction happens automatially.

这篇关于基于正则表达式的splunk查询的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！