Splunk Search

Regex merge match to single name

webshan
Engager

HI I have 2 log files(access log file and custom log file) with data as given below.

LogFile1 (access log)
GET /login HTTP/1.1 302 - 1234 800

Where 1234 is USERID

LogFile2 (custom file)
DATA EVENT->1234:loginTime SOME EVENT DESC

I want to get a report like below:

USER ACCESS_COUNT CUSTOM_COUNT
1234 4 5
2345 6 7
4567 7 8

I tried

source=access.log OR source=customlog.log QueryForAccess OR QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)|(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)"
|stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER

But I got cant use same pattern. I changed rex fields to USER1 & USER2 and stats as USER1,USER2 but could not get any result.

How do I ensure that I get report of USER who is in either access log or in custom log & their counts??

Thanks

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

I assume you are trying to have one rex pull a field from two different sourcetypes?

Consider two rex calls, something like this:

... | rex "some pattern" | rex "some other pattern" | ...

If you use different field names in each rex you can then merge them into one field using a combination of eval and a test for null/invalid values. However, using the same field name in both rex's should work as well. Just make sure the first pattern does not match the second sourcetype and vice versa.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

I assume you are trying to have one rex pull a field from two different sourcetypes?

Consider two rex calls, something like this:

... | rex "some pattern" | rex "some other pattern" | ...

If you use different field names in each rex you can then merge them into one field using a combination of eval and a test for null/invalid values. However, using the same field name in both rex's should work as well. Just make sure the first pattern does not match the second sourcetype and vice versa.

webshan
Engager

Thanks for inputs. I tried as below and it worked for me.

source=customlog.log QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)" |  stats count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER
| JOIN type=inner USER [SEARCH source=access.log OR QueryForAccess | rex "(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)" |stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT by USER ] | USER, CUSTOM_COUNT, ACCESS_COUNT
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...