Splunk Search

how to get custom table from logs

dhirendra224761
New Member

Hi, I am having trouble in my queries.
My logs are as below:
18/11/2018 12:00:41 IISYS export of Server 1 successfully transferred to Server 2
17/11/2018 03:32:09 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
16/11/2018 21:05:57 IISYS export of Server 1 successfully transferred to Server 3
16/11/2018 21:06:15 IISYS export of Server 1 successfully transferred to Server 4
17/11/2018 03:31:32 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
17/11/2018 03:36:55 IISYS Import successfully ended on server 1 from export of Server 3 with exit code 0

If imported then "OK" If not "KO" and for 3rd table, there is no export on sunday and no import processing on saturday.
Now I have to make tables based on above logs as below attached screenshot.

alt text

0 Karma

woodcock
Esteemed Legend

Your data does not match your chart. If you make them match, then maybe we can help you.

0 Karma

dhirendra224761
New Member

Hi @woodcock ... Sure I will corrct my logs as per the chart.

0 Karma

Richfez
SplunkTrust
SplunkTrust

What does a failed transfer or import look like? You didn't provide a log line for those...

The rest, or for anyone who wants to finish this answer after you provide that, might be along the lines of ...

base search ...
| rex "IISYS\s+(?<action>\w+) of (?<server>.*) (?<result>successfully|failed) transferred to (?<dest_server>.*)"
| rex "IISYS\s+(?<action>\w+) (?<result>successfully) ended on (?<server>.*) from export of (?<dest_server>.*) with exit code (?<exit_code>\d+)"
| eval in here to make result and exit_code all "OK" or "KO" as required
| timechart span=1d count by server, result_code.

Get us a sample of those log lines where it fails, so we know what to parse for the KO, and that should let us finish this for you.

0 Karma

dhirendra224761
New Member

Hi @rich7177,

Thanks for your input. especially for below rex command

| rex "IISYS\s+(?\w+) of (?.) (?successfully|failed) transferred to (?.)"

Let me try with this and let you know back again.
Thanks Again

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...