Reporting

Need help to get the Splunk report in below format based on above inputs where values (TransactionTypeCode & TxnId ) are dynamic in nature:

harishnpandey
Explorer

TxnProcess I >>>>>>>>> TransactionTypeCode for TxnId 3501574041788 is ABC
TxnProcess I >>>>>>>>> TransactionTypeCode for TxnId 3501689567745 is XYZ
TxnProcess I >>>>>>>>> TransactionTypeCode for TxnId 3501689456789 is PNR

Need help to get the Splunk report in below format based on above inputs where values (TransactionTypeCode & TxnId ) are dynamic in nature:

TransactionTypeCode TxnId

ABC 3501574041788
XYZ 3501689567745
PNR 3501689456789

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Here's one way, but I'm sure there are many others.

<your base search> | rex "TxnId (?<TxnId>\d+) is (?<TransactionTypeCode>\w+)" | table TransactionTypeCode TxnId
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's one way, but I'm sure there are many others.

<your base search> | rex "TxnId (?<TxnId>\d+) is (?<TransactionTypeCode>\w+)" | table TransactionTypeCode TxnId
---
If this reply helps you, Karma would be appreciated.
0 Karma

harishnpandey
Explorer

Thank you so much Rich,

It works perfectly . Just out of curiosity what w+ stand for (I have just started rex uses in Splunk)

Also ill it be easy way to get below o/p from given I/P. Appreciate your help

Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE

Output

Notification Type TypeCode
MQ EMAIL
MQ SMS
MQ VOICE

0 Karma

richgalloway
SplunkTrust
SplunkTrust

\w+ means "at least one word character". A word character is any alphanumeric character (a-zA-Z0-9) or underscore (_).

A good resource for regular expressions is regex101.com.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishnpandey
Explorer

OK. This helps a lot .

For below input I tried search query as

index=myindex "Notification"|rex "(MQ) (?\d+) = (?\w+)"|stats count(Notification)

However, its not working says "no result found". The moment I take off ==> stats count(Notification)
it shows values

Input:
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = EMAIL
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = SMS
[7/18/17 11:21:36:434 EDT] 00004b1d SystemOut O Notification Type (MQ) = VOICE

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...