topic Re: How to create a search from multiple sourcetypes? in Getting Data In

How to create a search from multiple sourcetypes?

kteng2024 — Wed, 14 Feb 2018 19:13:37 GMT

Hi,

Below are the three different source types from which I am trying to get the specific values as highlighted.

sourcetype: cg_log

2017-02-15T05:47:45.107+1100:
123564.781: [GC 123564.781: [ParameterNew: 637043K, 0.004 secs] 120590K->600476K(20761856K), 0.004 secs]

sourcetype: resp_log

2017-02-15 05:51:09.012890 id:155678,name:[AB05:RMS] Prod: apacheweb : Pool15 application pool,hostname:apacheweb.com,resptime:1378

sourcetype: jmx

2017-02-14 15:49:53 apacheweb.eu.com 318568616

Can someone please help me with the search . Below is the search i tried so far,

> sourcetype=cg_log GC [search
> sourcetype=resp_log resptime | table
> resptime GC]

Re: How to create a search from multiple sourcetypes?

muebel — Wed, 14 Feb 2018 20:48:54 GMT

Hi kteng,

I might not be following exactly what you are getting at, but this search will turn up all results from those sourcetypes, and do extractions for those fields

(sourcetype=cg_log OR sourcetype=resp_log OR sourcetype=jmx) | rex ".*GC\s(?<GC>[^:]+):.*" | rex ".*resptime:(?<resptime>\d+)\D" | rex ".*\s(?<jmx_field>\d+)$"

Or, at least, those regexes should be close.

The important might be to notice that the initial search string has a couple ORs to say "I want all results for these three sourcetypes"

Once you have those results, you can do whatever processing you like, as well as additional filtering.

Please let me know if this answers your question! 😄