topic Combine rex field in Splunk Enterprise

Combine rex field

DougiieDee — Thu, 10 Jun 2021 14:38:11 GMT

how do i combine both these rex field into one and display the count?

index=abc
"exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by ABC_CODE, Message

index=abc
ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code, Message

Re: Combine rex field

kamlesh_vaghela — Thu, 10 Jun 2021 16:03:31 GMT

@DougiieDee

Can you please try this?

index=abc ("exception":"CommonApplicationException" OR ABC-*) | rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE_1>[^\:]+)\:(?<Message_1>[^\"]+)" |rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" | eval ABC_CODE=if(isnotnull(ABC_CODE_1),ABC_CODE_1,ABC_CODE_2) | eval Message=if(isnotnull(Message),Message_1,Message_2) | where ABC_CODE!="" | stats count by ABC_CODE, Message

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Combine rex field

DougiieDee — Thu, 10 Jun 2021 18:52:06 GMT

The results are only showing from this

|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)"

other rex field didnt show the results.

Re: Combine rex field

kamlesh_vaghela — Fri, 11 Jun 2021 04:14:30 GMT

@DougiieDee

Can you please expand timerange if possible?

Meanwhile can you please share sample events from both search?

Re: Combine rex field

DougiieDee — Fri, 11 Jun 2021 14:43:39 GMT

1. {\"errors\":[{\"code\"\"ABC-1000\",\"message\"\"Sorry we are unable to process your request.

index=abc ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorry, it looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?