仅使用单个值提取特定字段值答案

【问题标题】：Specific field values extraction with single value only仅使用单个值提取特定字段值
【发布时间】：2018-05-28 05:48:33
【问题描述】：

需要提取只发送了一条短信（已接收）并且也“停止”的客户 msisdn（发件人）。日志如下 -

5/27/18 11:38:29.598 PM [2018-27-05 23:38:29.598 UTC] 信息 pool-1-thread-3 [receivedSmsFileLogger] - 收到 = "JE S8 TELMA MALADE”，来自 = “0765473387”，有效 = “false” 主机 = Vapp01SN 源 = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

5/27/18 9:28:30.569 PM [2018-27-05 21:28:30.569 UTC] INFO pool-1-thread-2 [receivedSmsFileLogger] - 收到 = “''STOP''”，发件人 = “0765757431”，有效 = “假” 主机 = Vapp01SN 源 = D:\MIP\Logs\SMSC\Cycle1\received_sms.log 源类型 = MIP_Received_SMS

5/27/18 9:26:25.034 PM [2018-27-05 21:26:25.034 UTC] INFO pool-1-thread-1 [receivedSmsFileLogger] - 收到 = “1OUI”，发件人 = “0765757431”，有效 = “假” 主机 = Vapp01SN 来源 = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

5/27/18 9:06:36.889 PM [2018-27-05 21:06:36.889 UTC] INFO pool-1-thread-3 [receivedSmsFileLogger] - 收到 = “停止”，来自 = “0766108902”，有效 = “真” 主机 = Vapp01SN 源 = D:\MIP\Logs\SMSC\Cycle1\received_sms.log sourcetype = MIP_Received_SMS

【问题讨论】：

标签： splunk splunk-query splunk-calculation

【解决方案1】：

试试这个

index=foo sourcetype=bar 
| rex "From\s*=\s*\\"(?<msisdn>\d+)" 
| rex "Received\s*=\s*\\"(?<msg>[^\\"]+)" 
| stats count(msg) as msgCount values(msg) as Msgs by msisdn 
| where msgCount=1 AND (mvindex(0,Msgs)=="STOP")

【讨论】：