Getting Data In

Parsing a Log File

kshahborr99
New Member

Hi,

I have a file with the below format :

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=NewJersey CustProduct=Cellphone RecName=Peter, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=NewJersey CustProduct=LanLine RecName=Peter_1, Adams_1 RecLoc=Bangalore Corp RecEmail=Peter_1.adams_1@yahoo.com

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=California CustProduct=Cellphone RecName=Peter, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

CustID=129859 CusTime=2012-04-04 CusName=Peter, Doe CustState=NewJersey CustProduct=Cellphone RecName=John, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

I want in a graphical / report format for each CustID the CusName and the different RecName he has been dealing with. And if the RecLoc is Mumbai Corp than categorize that as LOCAL else EXTERNAL.

So basically the output should be :

Cust ID CusName Count RecName RecLoc Type
129857 John, Doe 2 Peter, Adams Mumbai Corp LOCAL
129857 John, Doe 1 Peter_1,Adams_1 Bangalore Corp External

129859 Peter, Doe 1 John, Adams Mumbai Corp LOCAL

Pls let me know if this is possible and if you can pls provide a sample code I can try.

Thank you

Tags (1)
0 Karma

Lamar
Splunk Employee
Splunk Employee

Try this:

...<your data search> | eval Type=if(RecLoc="Mumbai Corp", "LOCAL", "External") | stats count as Count by CusName, RecName, RecLoc | fields CustID, CusName, RecName, Count, RecLoc, Type

Let me know if that gets you close.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...