topic Re: Raw data only parsing the first instance in Splunk Search

Raw data only parsing the first instance

praddasg — Fri, 27 Mar 2020 03:10:00 GMT

Hello All,

I have a data like this

X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

Now when I am using the query <search criteria> | table status, reason it is giving values "X" and "Y"
1. Trying to understand why it is not considering the values Z & Y and xyz & abc
2. If I have to get the result of values Z & Y and xyz & abc how to retrieve?

Re: Raw data only parsing the first instance

richgalloway — Fri, 27 Mar 2020 13:00:35 GMT

What is <search criteria>?

Re: Raw data only parsing the first instance

praddasg — Sat, 28 Mar 2020 14:22:55 GMT

Hi @richgalloway the raw data is like service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

and my <search criteria> is service

Re: Raw data only parsing the first instance

to4kawa — Sat, 28 Mar 2020 23:09:05 GMT

sample query:

| makeresults
| eval _raw="service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]"
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| table status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*

recommend:

<search criteria> 
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| fields status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*
| table status, reason

Re: Raw data only parsing the first instance

praddasg — Sat, 28 Mar 2020 23:16:51 GMT

Hello @to4kawa
It is still giving me values "X" and "Y"

Re: Raw data only parsing the first instance

to4kawa — Sat, 28 Mar 2020 23:56:05 GMT

use where OR search

Re: Raw data only parsing the first instance

praddasg — Sun, 29 Mar 2020 00:50:52 GMT

I am only using where but still the same

Re: Raw data only parsing the first instance

to4kawa — Sun, 29 Mar 2020 02:43:01 GMT

I see, your query is wrong

Re: Raw data only parsing the first instance

praddasg — Tue, 31 Mar 2020 01:34:12 GMT

Hi @to4kawa
can you please explain a bit more when you say the query is wrong? What I meant above is in the complete query I am not using search instead using where

service | where not reason like "%P%" |table status, reason

Re: Raw data only parsing the first instance

to4kawa — Tue, 31 Mar 2020 21:27:16 GMT

| where not reason like "%P%"

This can't work.
where "%P%" come from?
Don't you select NOT (status="X" AND reason="Y")?