topic Re: How to extract the profile from the log? in Splunk Search

How to extract the profile from the log?

yograjpatel — Thu, 25 Jan 2018 21:51:59 GMT

INFO Decrypted user token received as header:

{"phoneNumber":"888888888","firstName":"Alan ","lastName":"Mmm","email":"alan@mmmcom","id":"658336","guid":"f07286ef-d3ea-4319-ac45-39596354ce95","userType":"PROFILE_OWNER","profileId":"480783","profileGuid":"14d9b3a5-9350-435b-8f45-fe4556f465b7","profileName":"KARATE EAT NOW","profileOwnerPhoneNumber":"8585181878","profileOwnerFirstName":"Alan ","profileOwnerLastName":"Mmm","profileOwnerEmail":"alan@mmm.com","profileOwnerId":"658336"}

Re: How to extract the profile from the log?

yograjpatel — Thu, 25 Jan 2018 22:08:43 GMT

have tried the below but the unique values are not extracting.

" INFO Decrypted user token received as header" "profileId" | rex ":\s+(?\d+)\s+\/"

rex "\"profileId\"\s:\s\"(?P\d+)\""

just getting the total count.

Re: How to extract the profile from the log?

nickhills — Thu, 25 Jan 2018 22:30:43 GMT

If your trying to do this at search time your syntax is not quite correct.

try this:

...|rex field=_raw "profileId\":\"(?<profileId>\d+)\""|table profileId

Re: How to extract the profile from the log?

yograjpatel — Tue, 29 Sep 2020 17:48:30 GMT

is there a way to sort the count by month in ascending order.. like Nov, Dec, Jan.

I'm trying this but the data is not in order

Re: How to extract the profile from the log?

mayurr98 — Fri, 26 Jan 2018 03:40:18 GMT

try this

INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId) by month date_month| sort month | fields- month

let me know if this helps!

Re: How to extract the profile from the log?

yograjpatel — Fri, 26 Jan 2018 03:50:13 GMT

No it didnt help me

Re: How to extract the profile from the log?

yograjpatel — Fri, 26 Jan 2018 03:57:45 GMT

If I search for last 6 months its showing the chart like this...
Jan, July, Aug, Sep, Oct, Nov, Dec

Re: How to extract the profile from the log?

mayurr98 — Fri, 26 Jan 2018 04:08:18 GMT

then try this

 INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId)  by date_year date_month month | sort date_year month | fields- date_year month

Re: How to extract the profile from the log?

yograjpatel — Fri, 26 Jan 2018 14:14:17 GMT

thanks Mayur... this worked

Re: How to extract the profile from the log?

yograjpatel — Fri, 26 Jan 2018 16:24:52 GMT

How Can i Extract the user "pmcmurchy@com.net" from the log?

INFO User [pmcmurchy@com.net] successfully logged into Myaccount Portal on :Fri Jan 26 09:37:53 EST 2018