topic Re: splunk regex & xml in Splunk Search

splunk regex & xml

ritesh14 — Fri, 22 Jan 2021 18:49:50 GMT

question is two fold

question 1 -
here is sample log

messageType and dir is interesting field from splunk.

here is my query
index=sample_index source="source_1" dir=In messageType=Web | rex field=_raw "^(?:[^\|\n]*\|){8}(?P<transactions>[^\|]+)"

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

question 2 -
from above log last part xml data. here is sample xml

<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns3:trxn
xmlns:ns2="url1"
xmlns:ns3="url2">
<ResponseCode>OK</ResponseCode>
</ns3:trxn>
</soapenv:Body>
</soapenv:Envelope>

how can I get trxn and responnseCode here?

Re: splunk regex & xml

scelikok — Sat, 23 Jan 2021 13:59:58 GMT

Hi @ritesh14,

You can extract all in one regex;

^(?:[^\|\n]*\|){7}(?P<time>[^\|]+)\|(?P<transactions>[^\|]+)\|[^|]+<ResponseCode>(?P<responseCode>[^\<]+)[^|]+ns3:(?P<xml_trxn>[^\>]+)

If this reply helps you an upvote is appreciated.

Re: splunk regex & xml

spammenot66 — Sun, 24 Jan 2021 16:49:03 GMT

@ritesh14In regards to the question below, can you give a n example of where you're expecting two values for trxn and time? this can be interpreted multiple ways.

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

Re: splunk regex & xml

ritesh14 — Tue, 26 Jan 2021 13:09:58 GMT

in very simplest term..I have the query for single term either time or trxn and it worked fine.

I was looking for both value at the same time - trxn and time. basically I wanted to create a table with trxn and time. I did build the query but interesting not properly working

here is the two query I have build the responseTime coming on both are different

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| stats min(responseTime) AS "MinResponseTime" avg(responseTime) AS "AVG_ResponseTime" max(responseTime) AS "MaxResponseTime" by trxn
| eval AVG_ResponseTime=round(AVG_ResponseTime,0)
| sort -AVG_ResponseTime | table trxn MinResponseTime AVG_ResponseTime MaxResponseTime

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| timechart span=1m avg(responseTime) by trxn

if someone can help me what is wrong here

Re: splunk regex & xml

ritesh14 — Tue, 26 Jan 2021 14:06:58 GMT

I got the problem statement

response times coming as comma separated value like 1,008 that is 1 sec and 8 ms.

how the splunk can parse comma separated digit as single INT?

Thanks