Splunk Search

Regex merge match to single name

webshan
Engager

HI I have 2 log files(access log file and custom log file) with data as given below.

LogFile1 (access log)
GET /login HTTP/1.1 302 - 1234 800

Where 1234 is USERID

LogFile2 (custom file)
DATA EVENT->1234:loginTime SOME EVENT DESC

I want to get a report like below:

USER ACCESS_COUNT CUSTOM_COUNT
1234 4 5
2345 6 7
4567 7 8

I tried

source=access.log OR source=customlog.log QueryForAccess OR QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)|(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)"
|stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER

But I got cant use same pattern. I changed rex fields to USER1 & USER2 and stats as USER1,USER2 but could not get any result.

How do I ensure that I get report of USER who is in either access log or in custom log & their counts??

Thanks

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I assume you are trying to have one rex pull a field from two different sourcetypes?

Consider two rex calls, something like this:

... | rex "some pattern" | rex "some other pattern" | ...

If you use different field names in each rex you can then merge them into one field using a combination of eval and a test for null/invalid values. However, using the same field name in both rex's should work as well. Just make sure the first pattern does not match the second sourcetype and vice versa.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I assume you are trying to have one rex pull a field from two different sourcetypes?

Consider two rex calls, something like this:

... | rex "some pattern" | rex "some other pattern" | ...

If you use different field names in each rex you can then merge them into one field using a combination of eval and a test for null/invalid values. However, using the same field name in both rex's should work as well. Just make sure the first pattern does not match the second sourcetype and vice versa.

webshan
Engager

Thanks for inputs. I tried as below and it worked for me.

source=customlog.log QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)" |  stats count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER
| JOIN type=inner USER [SEARCH source=access.log OR QueryForAccess | rex "(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)" |stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT by USER ] | USER, CUSTOM_COUNT, ACCESS_COUNT
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...