Splunk：如何通过正则与聚合从搜索结果提取并汇总数据

原始搜索语句 #

my search | eval LINE=(MESSAGE) | where MESSAGE LIKE "Process : Hp:%" 
| stats values(DATETIME) as Date values(LINE) as Status

原始搜索结果 #

Date                                Status
2023-10-31          Process : Hp: N1 - NOEAST WorkId: 9 Numbers: 209 Cases: 224 Lines: 465         
2023-10-31          Process : Hp: N1 - NOEAST WorkId: 9 Numbers: 499 Cases: 577 Lines: 954         
2023-11-02          Process : Hp: N2 - NOEAST WorkId: 13 Numbers: 178 Cases: 230 Lines: 376         
2023-11-03          Process : Hp: N2 - NOEAST WorkId: 13 Numbers: 466 Cases: 497 Lines: 725         
2023-11-03          Process : Hp: O1 - SOWEST WorkId: 11 Numbers: 182 Cases: 275 Lines: 619   

目标结果 #

HP                  Total Numbers     Total Cases     Total Lines
N1 - NOEAST 9          708             801              1419
N2 - NOEAST 13         644             727              1101
O1 - SOWEST 11         182             275               619

问题 #

能否通过子搜索和正则提取实现上述目标？若可以请给出示例，或者是否有更简便的实现方法？

解答 #

不需要子搜索，直接在原始搜索流程中加入正则提取与聚合求和即可，这是最高效简洁的方案。

最优实现搜索语句

my search 
| where MESSAGE LIKE "Process : Hp:%" 
| rex field=MESSAGE "Process : Hp: (?<HP>[^ ]+ - [^ ]+) WorkId: (?<WorkId>\d+) Numbers: (?<Numbers>\d+) Cases: (?<Cases>\d+) Lines: (?<Lines>\d+)"
| eval HP = HP . " " . WorkId
| eval Numbers = tonumber(Numbers), Cases = tonumber(Cases), Lines = tonumber(Lines)
| stats sum(Numbers) as "Total Numbers", sum(Cases) as "Total Cases", sum(Lines) as "Total Lines" by HP
| table HP "Total Numbers" "Total Cases" "Total Lines"

关键步骤说明

1. 正则提取字段：用rex从MESSAGE中拆分出分组标识（HP名称、WorkId）以及需要求和的数值字段；
2. 合并分组字段：通过eval将HP名称与WorkId合并为目标中的HP字段；
3. 转换数值类型：用tonumber确保Numbers、Cases、Lines为数值类型，避免求和时出现字符串拼接错误；
4. 聚合求和：通过stats ... by HP按分组对数值字段求和，最后用table调整字段顺序匹配目标格式。

子搜索实现示例（不推荐）

如果一定要用子搜索实现，可参考以下语句，但该方案会增加搜索复杂度，效率低于直接处理：

[ search my search | where MESSAGE LIKE "Process : Hp:%" | fields MESSAGE ]
| rex field=MESSAGE "Process : Hp: (?<HP>[^ ]+ - [^ ]+) WorkId: (?<WorkId>\d+) Numbers: (?<Numbers>\d+) Cases: (?<Cases>\d+) Lines: (?<Lines>\d+)"
| eval HP = HP . " " . WorkId
| eval Numbers = tonumber(Numbers), Cases = tonumber(Cases), Lines = tonumber(Lines)
| stats sum(Numbers) as "Total Numbers", sum(Cases) as "Total Cases", sum(Lines) as "Total Lines" by HP
| table HP "Total Numbers" "Total Cases" "Total Lines"

内容的提问来源于stack exchange，提问作者H22