topic Re: how to get custom table from logs in Splunk Search

how to get custom table from logs

dhirendra224761 — Sun, 25 Nov 2018 07:26:32 GMT

Hi, I am having trouble in my queries.
My logs are as below:
18/11/2018 12:00:41 IISYS export of Server 1 successfully transferred to Server 2
17/11/2018 03:32:09 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
16/11/2018 21:05:57 IISYS export of Server 1 successfully transferred to Server 3
16/11/2018 21:06:15 IISYS export of Server 1 successfully transferred to Server 4
17/11/2018 03:31:32 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
17/11/2018 03:36:55 IISYS Import successfully ended on server 1 from export of Server 3 with exit code 0

If imported then "OK" If not "KO" and for 3rd table, there is no export on sunday and no import processing on saturday.
Now I have to make tables based on above logs as below attached screenshot.

Re: how to get custom table from logs

Richfez — Sun, 25 Nov 2018 13:07:09 GMT

What does a failed transfer or import look like? You didn't provide a log line for those...

The rest, or for anyone who wants to finish this answer after you provide that, might be along the lines of ...

base search ...
| rex "IISYS\s+(?<action>\w+) of (?<server>.*) (?<result>successfully|failed) transferred to (?<dest_server>.*)"
| rex "IISYS\s+(?<action>\w+) (?<result>successfully) ended on (?<server>.*) from export of (?<dest_server>.*) with exit code (?<exit_code>\d+)"
| eval in here to make result and exit_code all "OK" or "KO" as required
| timechart span=1d count by server, result_code.

Get us a sample of those log lines where it fails, so we know what to parse for the KO, and that should let us finish this for you.

Re: how to get custom table from logs

dhirendra224761 — Sun, 25 Nov 2018 13:28:45 GMT

Hi @rich7177,

Thanks for your input. especially for below rex command

| rex "IISYS\s+(?\w+) of (?.) (?successfully|failed) transferred to (?.)"

Let me try with this and let you know back again.
Thanks Again

Re: how to get custom table from logs

woodcock — Sun, 25 Nov 2018 18:56:57 GMT

Your data does not match your chart. If you make them match, then maybe we can help you.

Re: how to get custom table from logs

dhirendra224761 — Sun, 25 Nov 2018 19:36:28 GMT

Hi @woodcock ... Sure I will corrct my logs as per the chart.