Splunk Search

How do I display a table with the fields extracted from regex?

gvssaicharan
Engager

I built a regular expression to extract fields from a log file. However, after extracting I am not able to display the extracted fields in table format. The regular expression seems to be working online. https://regex101.com/r/ZcYOhG/2

I want to display the extracted fields in a table format. Can someone help me?

0 Karma
1 Solution

mayurr98
Super Champion

try this:

index=<your_index>
| rex field=_raw "transactionId=(?<transactionId>[^\}]+)\}.*ResourceId\:\s(?<featureName>[^\,]+),.*CPNYID_(?<companyId>\d+)_AID_(?<aPaymentId>\d+)" 
| stats count by aPaymentId companyId featureName transactionId

View solution in original post

mayurr98
Super Champion

try this:

index=<your_index>
| rex field=_raw "transactionId=(?<transactionId>[^\}]+)\}.*ResourceId\:\s(?<featureName>[^\,]+),.*CPNYID_(?<companyId>\d+)_AID_(?<aPaymentId>\d+)" 
| stats count by aPaymentId companyId featureName transactionId

gvssaicharan
Engager

Thank you for the quick reply. It worked well.
Can you explain why the same regex did not worked in splunk as is.
You made little tweaks in the expression.

0 Karma

mayurr98
Super Champion

whats the query you are using to display the fields in table format?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...