topic Re: Need help with query in Dashboards & Visualizations

Need help with query

Mrig342 — Fri, 30 Apr 2021 11:57:40 GMT

Hi All,

I am trying to extract a field from the below log.

log1:

I created the below query to extract the field "App_Name" which is "ESB_HealthCheck|esbgc_as_uat2_dom"from the log:

| rex field=_raw "^[^\|\n]*\|(?P<App_Name>[^\|]+)"

Here, I am getting the value from the line one only. How will I be able to extract the value from all the lines in the log.

Please help me creating the query to get the desired output.

Your kind support will be highly appreciated.

Thank you.

Re: Need help with query

manjunathmeti — Fri, 30 Apr 2021 12:12:48 GMT

hi @Mrig342,

Try this:

| rex "\/(?<App_Name>\w+\|\w+)"

Re: Need help with query

gcusello — Fri, 30 Apr 2021 12:17:03 GMT

Hi @Mrig342,

let me understand: the rows you shared are from one event or from more events?

if they come from more events, your regex is correct,

if instead your rows come from one event, you have to modify your regex, something like this:

| rex "(?ms)^[^\|\n]*\|(?P<App_Name>[^\|]+)"

but I think that, if all the rows come from only one event, the problem isn't the field extraction, but the event separation because you have a timestamp in each row.

Your props.con reaches to divide the events?

Ciao.

Giuseppe

Re: Need help with query

ITWhisperer — Fri, 30 Apr 2021 12:17:37 GMT

Are these lines all in one event? If so, you could use max_match=0 to give you a multi-value field of App_Names

Re: Need help with query

Mrig342 — Mon, 03 May 2021 06:35:52 GMT

Hi @gcusello,

Thank you very much for your reply and suggestion.

The lines are of one event. You can consider as below:

log1:

log2:

etc. and some logs might have 3 or more lines too.

When trying with the query you gave ("(?ms)^[^\|\n]*\|(?P<App_Name>[^\|]+)"), I am getting output as:

App_Name = ESB/Services/ProductBaseV6/Prov_DepositsAndRatesServices_6A

Also I tried to give a max_match=0 to consider multivalues using query (| rex field=_raw "(?ms)^[^\|\n]*\|(?P<App_Name>[^\|]+)"), I am getting output as:

App_Name = ESB/Services/ProductBaseV6/Prov_DepositsAndRatesServices_6A App_Name = esbgc_ss_uat2_dom App_Name = Synchronized App_Name = Sat 01-May-2021 08:13:18 EST App_Name = 1 esbgc_as_uat2_dom App_Name = ESB/Services/ProductBaseV6/Prov_DepositsAndRatesServices_6A App_Name = esbgc_as_uat2_dom App_Name = Synchronized App_Name = Sat 01-May-2021 08:13:32 EST App_Name = 1

Here, it is considering everything as App_Name.

Please help look into it and correct the query.

Thank you.

Re: Need help with query

ITWhisperer — Mon, 03 May 2021 07:00:14 GMT

It is a little difficult to tell if there are line-breaks between the "lines" or whether it has simply word-wrapped. Assuming that there are line-breaks, (?m)^ takes care of them so you should only need to skip past the first pipe-delimited part on each line.

| rex max_match=0 "(?m)^[^\|]*\|(?P<App_Name>[^\|]+)"

Re: Need help with query

Mrig342 — Mon, 03 May 2021 08:07:14 GMT

Hi @ITWhisperer,

Thank you for your suggestion.

However the query still gives output as before.

App_Name = ESB/Services/ProductBaseV6/Prov_DepositsAndRatesServices_6A App_Name = esbgc_ss_uat2_dom App_Name = Synchronized App_Name = Sat 01-May-2021 08:13:18 EST App_Name = 1 esbgc_as_uat2_dom App_Name = ESB/Services/ProductBaseV6/Prov_DepositsAndRatesServices_6A App_Name = esbgc_as_uat2_dom App_Name = Synchronized App_Name = Sat 01-May-2021 08:13:32 EST App_Name = 1

Seems line break is the issue. Considering to configure the line breaks and will try then.

If you can suggest anything else, it's welcomed.

Thank you very much for your support.

Re: Need help with query

ITWhisperer — Mon, 03 May 2021 08:16:29 GMT

Assuming there are line-breaks, try this:

Re: Need help with query

Mrig342 — Tue, 04 May 2021 06:14:57 GMT

Hi @ITWhisperer,

This query works fine. Thank you very much for your support.