topic Re: How can one represent different values for a single extracted field? in Splunk Search

How can one represent different values for a single extracted field?

cb046891 — Sun, 20 Oct 2019 16:32:05 GMT

This issue comes from the error logs of a login service. When a user scans their badge and attempts to log in with an invalid alias the resulting service exception will contain the following example text: "Unable to lookup personnel with barcode: 554067 and orgId: 1217864."

I've created a report to extract these events, it's a simple search containing "| rex field=_raw "barcode: (?< Alias>.) and orgId: (?< OrgID>.).""

This will generate the fields "Alias" and "OrgID." Valid aliases should be a 6 digit number. However, due to users scanning the wrong barcode, we see values of Alias like AC000000000000, NE000000 or sometimes a 6 letter alpha string. Is there any way for me to represent the count/percentage of invalid values of Alias? Ideally I'd want to create a graphical representation of this with a Pie Chart.

Re: How can one represent different values for a single extracted field?

richgalloway — Sun, 20 Oct 2019 22:51:56 GMT

Perhaps this will get you started.

... | | rex "barcode: (?<Alias>\S+) and orgId: (?<OrgID>[^\.]+)"
| eval is_valid = if(len(Alias) == 6 AND isnum(Alias), 1, 0)
| stats count(eval(is_valid==1)) as Valid, count(eval(is_valid==0)) as Invalid

Re: How can one represent different values for a single extracted field?

cb046891 — Tue, 12 Nov 2019 14:41:53 GMT

Sorry I'm late getting back to you! This did send me in the right direction! I ended up using Eval with a case to classify the aliases that I was seeing:

| eval AliasType = case(
    match(Alias, "AC*") AND len(Alias) >= 10,"Class1",
    len(Alias) == 6 AND isnum(Alias), "Class2",
    match(Alias, "NE*"), "Class3",
    len(Alias) == 12 AND isnum(Alias), "Class4,
    !isnum(Alias) OR len(Alias) != 12 OR len(Alias) != 6, "Class5"
    )