Cannot convert a rex pattern variable to use in a chart

gsbpp — Thu, 30 Jul 2020 18:37:14 GMT

I have the following splunk event:

2020-Jul-30 18:19:02.891Z level=DEBUG thread=https-jsse-nio-2720-exec-9 pid=20 code_location=c.x.p.service.WebhookEventServiceImpl request_id=1fPwftTa2ylVm7CbcwnBirNhhjX trace_id=79d2157d38d3fd37 Processing message event[id=WH-29K757251Y0625428-0EP848134S044830M; resourceType=dispute; paypalDebugId=bac532dd23d05] using routingKey[com.xoom.paypal-events.v1.CUSTOMER.DISPUTE.UPDATED].

1. I want to create a chart that aggregates by resourceType and routingKey.

2. I have the following command

index="myindex" sourcetype="mySourceType" "Processing message event" | rex field=instance "routingKey\[(?<eventType>)\]\s" | chart count by resourceType eventType

3. The result I get is just by resourceType. I am not able to assign the <eventType> variable to a field name for the chart.splunk chart

Re: Cannot convert a rex pattern variable to use in a chart

richgalloway — Thu, 30 Jul 2020 18:54:19 GMT

The rex command is trying match against the instance field, but that field doesn't exist in the sample event. Try using

| rex field=_raw ...

Re: Cannot convert a rex pattern variable to use in a chart

isoutamo — Thu, 30 Jul 2020 19:45:13 GMT

your regex for eventType needs fixing. Please try this

\[(?<eventType>[^\]]+)

r. Ismo

topic Cannot convert a rex pattern variable to use in a chart in Splunk Search

Cannot convert a rex pattern variable to use in a chart

Re: Cannot convert a rex pattern variable to use in a chart

Re: Cannot convert a rex pattern variable to use in a chart