Splunk Search

How to extract the profile from the log?

yograjpatel
New Member

INFO Decrypted user token received as header:

{"phoneNumber":"888888888","firstName":"Alan ","lastName":"Mmm","email":"alan@mmmcom","id":"658336","guid":"f07286ef-d3ea-4319-ac45-39596354ce95","userType":"PROFILE_OWNER","profileId":"480783","profileGuid":"14d9b3a5-9350-435b-8f45-fe4556f465b7","profileName":"KARATE EAT NOW","profileOwnerPhoneNumber":"8585181878","profileOwnerFirstName":"Alan ","profileOwnerLastName":"Mmm","profileOwnerEmail":"alan@mmm.com","profileOwnerId":"658336"}
Tags (2)
0 Karma
1 Solution

nickhills
Ultra Champion

If your trying to do this at search time your syntax is not quite correct.

try this:

...|rex field=_raw "profileId\":\"(?<profileId>\d+)\""|table profileId
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

nickhills
Ultra Champion

If your trying to do this at search time your syntax is not quite correct.

try this:

...|rex field=_raw "profileId\":\"(?<profileId>\d+)\""|table profileId
If my comment helps, please give it a thumbs up!
0 Karma

yograjpatel
New Member

is there a way to sort the count by month in ascending order.. like Nov, Dec, Jan.

I'm trying this but the data is not in order

INFO Decrypted user token received as header" "profileId" | eval Month=strftime(_time,"%b") | rex field=_raw "profileId\":\"(?\d+)\""|dedup profileId | stats count(profileId) by Month | sort -_time

0 Karma

yograjpatel
New Member

How Can i Extract the user "pmcmurchy@com.net" from the log?

INFO User [pmcmurchy@com.net] successfully logged into Myaccount Portal on :Fri Jan 26 09:37:53 EST 2018

0 Karma

mayurr98
Super Champion

try this

INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId) by month date_month| sort month | fields- month

let me know if this helps!

0 Karma

yograjpatel
New Member

No it didnt help me

0 Karma

yograjpatel
New Member

If I search for last 6 months its showing the chart like this...
Jan, July, Aug, Sep, Oct, Nov, Dec

0 Karma

mayurr98
Super Champion

then try this

 INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId)  by date_year date_month month | sort date_year month | fields- date_year month
0 Karma

yograjpatel
New Member

thanks Mayur... this worked

0 Karma

yograjpatel
New Member

have tried the below but the unique values are not extracting.

" INFO Decrypted user token received as header" "profileId" | rex ":\s+(?\d+)\s+\/"

rex "\"profileId\"\s:\s\"(?P\d+)\""

just getting the total count.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...