topic Re: How to create a regex for unmapped queries? in Splunk Search

How to create a regex for unmapped queries?

Nidd — Thu, 22 Aug 2019 06:48:52 GMT

I have Splunk logs like:

class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType|

There would be many many logs of this format.

I now need to extract a couple of timestamps and populate in a table. Eg: '2019-08-21 23:17:58.562' and '2019-08-21 23:17:58.994,432' from the above log and display as:
-------------------------------------------------------------------
StartTime EndTime
-------------------------------------------------------------------
2019-08-21 23:17:58.562 2019-08-21 23:17:58.994
-------------------------------------------------------------------

Can someone please help?

Re: How to create a regex for unmapped queries?

nareshinsvu — Thu, 22 Aug 2019 07:04:24 GMT

Try this: Keep in mind that this only helps if the time placements are at the same position for all your log content. If your input is of csv format with all headers, extraction would have been easy

|makeresults
|eval _raw="class,method,user,transactionType,,428856645467856301,1073258159,50213,5,2019-08-21 23:17:58.562,2019-08-21 23:17:58.994,432,,,,4,45170632,19634442,,,,159,52297220,801767,,,,,,,b4a954df-8c77-4a30-b4ac-68ec9afe9a48,,,,TransactionType=transactionType" 
|eval fields=split(_raw,",") 
| eval Start_time=mvindex(fields,9), End_time=mvindex(fields,10) 
| table Start_time End_time

Re: How to create a regex for unmapped queries?

Nidd — Thu, 22 Aug 2019 07:08:42 GMT

Found this:

<mySearch> | rex "^(?:(?<TransactionStartTime>[^,]*),){10}" | rex "^(?:(?<TransactionEndTime>[^,]*),){11}" | table TransactionStartTime, TransactionEndTime

Re: How to create a regex for unmapped queries?

Nidd — Thu, 22 Aug 2019 07:09:42 GMT

Yes. I understand Naresh. Thanks for your answer. I accept your answer as well.