topic Re: How to Extract specific word from application log in Splunk Search

How to Extract specific word from application log

iqbalintouch — Tue, 12 Jan 2021 07:42:37 GMT

Here is the sample log and I need to check which modelId is having most of the error using rex and stats count

####<Jan 11, 2021 11:17:52.338 PM PST> <ERROR> <myapp.main.catalog.store.trxn.OrderResponseValidator> <bus-ser15> <bus-ser1515_5> <requestId=9c4q00cv-e10x-00b4-z55f-11b44dc4c37m> <clientIp=11.22.33.222> <myapp.main.catalog.store.trxn.OrderResponseValidator.logOrderResponseValidationError(?:?):Productadd service error for modelId 765431 and reference number null[Model is not available in the store], [An error has occurred. Please verify your order status.]>

Can someone please help?

Re: How to Extract specific word from application log

scelikok — Tue, 12 Jan 2021 07:49:19 GMT

Hi @iqbalintouch,

You can use below query;

| rex field=_raw "modelId\s(?<modelId>\d+)" | stats count by modelId

If this reply helps you an upvote is appreciated.

Re: How to Extract specific word from application log

iqbalintouch — Sun, 17 Jan 2021 17:54:34 GMT

Hi @scelikok ,
thank you, I was looking for this thing exactly. Sorry for the late reply 🙂