Hi,
I have this query, what I'm trying to do is pull the mac address out of events with a 405 error dedup them then put them in a table. Then taking that table search the same index and match on mac address and pull out the external account id and finally put the mac address and external account id in a table. I can break apart the query and it seems to work, just not working when I put it together. Thoughts?
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|table extref|where len(extref)<10|table mac extref
Try this
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})" | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac
Try this
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})" | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac
Can you convert to answer?
ahhhh search then [search
Thanks Somesoni2!!!
failed attempt #2
index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac