topic extract two values as field from following log and show average count of requests. in Splunk Enterprise

extract two values as field from following log and show average count of requests.

nandhiniG — Mon, 31 Aug 2020 09:41:02 GMT

i want to extract two values from the below log message like TestUser as one field(featuename) and accounts_fetch as scenario name , and visualize the average requests for featurename +sceanrioname

"Successfully retrieved the account details for user: KL**19**19**19**19**11**11**11** with feature: TestUser, scenario: accounts_fetch"

Re: extract two values as field from following log and show average count of requests.

ITWhisperer — Mon, 31 Aug 2020 10:30:46 GMT

... base search | rex "feature: \"(?<featurename>[^,]+), scenario: (?<scenarioname>[^\"]+)\"" | eval combined=featurename + "+" + scenarioname

You can now use stats to count by combined over some time period (e.g. 1hr), then another stats to take average counts for that period over a longer period (e.g. 1 day) although it isn't clear if that is what you mean by average requests

Re: extract two values as field from following log and show average count of requests.

nandhiniG — Mon, 31 Aug 2020 11:14:15 GMT

I used the suggested pattern with sma;ll changes for extracting field as table ,

"Successfully retrieved the account details for user:"| rex
field=msg "feature: \"(?<featurename>[^,]+), scenario: (?<scenarioname>[^\"]+)\"" | table featurename scenarioname

but the string value is not extracted in table i see empty tables

Re: extract two values as field from following log and show average count of requests.

ITWhisperer — Mon, 31 Aug 2020 11:23:57 GMT

The pattern had extra double quotes in which were not needed

"Successfully retrieved the account details for user:"| rex field=msg "feature: (?<featurename>[^,]+), scenario: (?<scenarioname>.+)" | table featurename scenarioname

Re: extract two values as field from following log and show average count of requests.

nandhiniG — Mon, 31 Aug 2020 11:40:19 GMT

Thank you !!! it works