topic Re: Fetching the keywords and creating queries in Dashboards & Visualizations

Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 14:09:50 GMT

Hi Team,

Could you please guide how I can fetch the below keywords from raw logs:

2023-06-29 09:41:53.884 [INFO ] [pool-2-thread-1] ArchivalProcessor - finished reading file /absin/TRIM.ARCH.D062923.T052525

2023-06-28 10:36:24.064 [INFO ] [pool-2-thread-1] ArchivalProcessor - finished reading file / absin/TRIM.ARCH.D062823.T063718

2023-06-29 09:38:03.308 [INFO ] [pool-2-thread-1] ArchivalProcessor - Processing archival records for file TRIM.ARCH.D062923.T052525

Can someone guide me how can I fetch from raw logs.

Re: Fetching the keywords and creating queries

gcusello — Wed, 12 Jul 2023 14:20:28 GMT

Hi @aditsss,

you have to use a regex like the following:

| rex "file\s+(?<filename>.*)"

that you can test at https://regex101.com/r/Uc21zy/1

Ciao.

Giuseppe

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 14:22:52 GMT

@gcusello could you please provide me the complete query:

My current query is this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/app/abs-upstreamer/logs/abs-upstreamer.log" "finished reading file"

Re: Fetching the keywords and creating queries

gcusello — Wed, 12 Jul 2023 14:26:28 GMT

Hi @aditsss,

please try this

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/app/abs-upstreamer/logs/abs-upstreamer.log" "finished reading file" | rex "file\s+(?<filename>.*)" | table filename

Ciao.

Giuseppe

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 15:23:22 GMT

Hi @gcusello

I want something like this

finished reading file /absin/TRIM.ARCH.D062923.T052525 2023-06-29 09:41:53.884

One side it should be this and other side it should be date.

@gcusello how can we create query for this. Please guide

2023-06-29 09:41:53.884 [INFO ] [pool-2-thread-1] ArchivalProcessor - finished reading file /absin/TRIM.ARCH.D062923.T052525

Also I don't want tabular format is that possible I can create bar chart.

Current query:

index="abx*" sourcetype=600000304_gg_abs_ipc2 source="/app/abs-upstreamer/logs/abs-upstreamer.log" "finished reading file"| rex "file\s+(?<filename>.*)"

Re: Fetching the keywords and creating queries

gcusello — Wed, 12 Jul 2023 15:26:30 GMT

Hi @aditsss,

please try this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/app/abs-upstreamer/logs/abs-upstreamer.log" "finished reading file" | rex "file\s+(?<filename>.*)" | eval filename="finished reading file ".filename | table filename _time

Ciao.

Giuseppe

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 15:32:19 GMT

Thanks @gcusello

But I want to create in bar chart format please guide.

Re: Fetching the keywords and creating queries

gcusello — Wed, 12 Jul 2023 15:36:51 GMT

Hi @aditsss,

let me understand: you have a string in a column and a date in another, how do you want to put them in a chart?

Ciao.

Giuseppe

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 15:38:59 GMT

@gcusello

I want string on bar and date down

Re: Fetching the keywords and creating queries

gcusello — Wed, 12 Jul 2023 15:40:53 GMT

Hi @aditsss,

if you want a timeline, you have to use the timeline Add-On at https://splunkbase.splunk.com/app/3120

There isn't any other solution.

Ciao.

Giuseppe

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 15:43:30 GMT

@gcusello

I just want date down and string in column or bar format.

Can you guide me with timechart

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 15:57:08 GMT

@gcusello

I tried like this but not getting any result:

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 17:05:25 GMT

@gcusello

I am trying this query:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "Processing archival records for file "
| rex "file\s+(?<filename>.*)"
| eval filename="Processing archival records for file ".filename
| stats count by filename

I am able to see result like this:

filename count

Processing archival records for file TRIM.ARCH.D062723.T061108 1

I want to see result like this

filename Date

Processing archival records for file TRIM.ARCH.D062723.T061108 2023-06-27 09:29:11.022

@gcusello please guide

Re: Fetching the keywords and creating queries

aditsss — Wed, 12 Jul 2023 17:18:01 GMT

Hi @gcusello

I had tried like this:

index="abc*" sourcetype=600000304_gg_abs_ipc2 source="/amex/app/abs-upstreamer/logs/abs-upstreamer.log" "finished reading file"
| rex "file\s+(?<filename>.*)"
| eval filename="finished reading file ".filename
| stats count by filename

I am getting result like this:

filename count

finished reading file TRIM.ARCH.D062623.T053124 1

I want something like this

filename Date

finished reading fileTRIM.ARCH.D062623.T053124 2023-06-29 09:41:53.884

Re: Fetching the keywords and creating queries

gcusello — Thu, 13 Jul 2023 06:26:45 GMT

Hi @aditsss,

as I said, in a chart you can insert a count or a value but never a string.

You can eventually have a timechart, but always with a value (a count or a sum) never with a string.

The only way to have a chart is the Timeline add-on.

Otherwise, you can have a table like the one you shared.

ciao.

Giuseppe

Re: Fetching the keywords and creating queries

gcusello — Fri, 14 Jul 2023 06:33:49 GMT

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉