Parsing a Log File

kshahborr99 — Mon, 28 Sep 2020 11:57:52 GMT

Hi,

I have a file with the below format :

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=NewJersey CustProduct=Cellphone RecName=Peter, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=NewJersey CustProduct=LanLine RecName=Peter_1, Adams_1 RecLoc=Bangalore Corp RecEmail=Peter_1.adams_1@yahoo.com

CustID=129857 CusTime=2012-04-04 CusName=John, Doe CustState=California CustProduct=Cellphone RecName=Peter, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

CustID=129859 CusTime=2012-04-04 CusName=Peter, Doe CustState=NewJersey CustProduct=Cellphone RecName=John, Adams RecLoc=Mumbai Corp RecEmail=Peter.adams@yahoo.com

I want in a graphical / report format for each CustID the CusName and the different RecName he has been dealing with. And if the RecLoc is Mumbai Corp than categorize that as LOCAL else EXTERNAL.

So basically the output should be :

Cust ID CusName Count RecName RecLoc Type
129857 John, Doe 2 Peter, Adams Mumbai Corp LOCAL
129857 John, Doe 1 Peter_1,Adams_1 Bangalore Corp External

129859 Peter, Doe 1 John, Adams Mumbai Corp LOCAL

Pls let me know if this is possible and if you can pls provide a sample code I can try.

Thank you

Re: Parsing a Log File

Lamar — Wed, 20 Jun 2012 02:26:16 GMT

Try this:

...<your data search> | eval Type=if(RecLoc="Mumbai Corp", "LOCAL", "External") | stats count as Count by CusName, RecName, RecLoc | fields CustID, CusName, RecName, Count, RecLoc, Type

Let me know if that gets you close.

topic Parsing a Log File in Getting Data In

Parsing a Log File

Re: Parsing a Log File