Splunk Search

How to use rex command to extract two fields and chart the count for both in one search query?

anuarora
Engager

I have a log statement like 2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{"message":{"TransactionStatus":true,"TransactioName":"removeLockedUser-1498029828160"}} .
How can i extract TransactionName and TranscationStatus and print in table form TransactionName and its count

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{\"message\":{\"TransactionStatus\":true,\"TransactioName\":\"removeLockedUser-1498029828160\"}}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "{\"TransactionStatus\":(?<TransactionStatus>[^,]*),\"TransactioName\":\"(?<TransactioName>[^\"]*)\""
| chart count OVER TransactioName BY TransactionStatus

SPECIAL NOTE: Are you sure there is not a missing n in your given text for TransactioName (this may have to be adjusted)?

View solution in original post

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{\"message\":{\"TransactionStatus\":true,\"TransactioName\":\"removeLockedUser-1498029828160\"}}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "{\"TransactionStatus\":(?<TransactionStatus>[^,]*),\"TransactioName\":\"(?<TransactioName>[^\"]*)\""
| chart count OVER TransactioName BY TransactionStatus

SPECIAL NOTE: Are you sure there is not a missing n in your given text for TransactioName (this may have to be adjusted)?

anuarora
Engager

Thanks Mr. Woodcock. This saved me a lot of time.

0 Karma

horsefez
SplunkTrust
SplunkTrust

@woodcock
btw: Your syntax for "COMMENT" is not wrong, but there is a new one (since 6.5) you might find interesting.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Search/Addcommentstosearches

0 Karma

woodcock
Esteemed Legend

I like mine better. When the create a genuine comment command, not a macro, then I will switch.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi anuarora
you could use this regex to extract your two fields:

\{\"TransactionStatus\"\:(?<TransactionStatus>[^,]*),\"TransactioName\"\:\"(?<TransactioName>[^\"]*)\"

you can put it in Field extraction or in rex command

| rex "\{\"TransactionStatus\"\:(?<TransactionStatus>[^,]*),\"TransactioName\"\:\"(?<TransactioName>[^\"]*)\""

Test it at https://regex101.com/r/8Ff4ji/1

Bye.
Giuseppe

0 Karma

anuarora
Engager

I tried below query but didn't get any success. It is always giving me 0.

sourcetype=10.240.204.69 "TransactionStatus" | rex field=_raw ".TransactionStatus (?.)" |stats count((status=true)) as success_count

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...