topic Table view in Splunk Search

Table view

venkat0896 — Mon, 22 Jul 2019 14:17:38 GMT

Hi Guys in splunk i need to create a report . i am trying to create a table with two columns please find the search key below

messageTypeKey=CM0001 ,disQualificationMessage=Cancelled by validation rules. SafeTimeNoPhoneHasNoEmail
Table messageTypeKey,disQualificationMessage

i need the message key and disqualification message
but the table looks like
CM0001 Cancelled

the message after the Cancelled is not appending
i need some suggestions on this
thanks in advance

Re: Table view

vnravikumar — Mon, 22 Jul 2019 14:57:15 GMT

Can you provide your query with sample events?

Re: Table view

venkat0896 — Mon, 22 Jul 2019 15:25:07 GMT

source=" " status="Cancelled" | table messageTypeKey,disQualificationMessage

Re: Table view

DavidHourani — Mon, 22 Jul 2019 15:28:42 GMT

Hi @venkat0896,

This makes total sense because you are allowing splunk to auto-extract the field.

By default the extraction that happens is KV which means key-value and in the case of disQualificationMessage=Cancelled by validation rulesthe value is only Cancelled and not the entire message.

What you will need to do is extract a new field matching exactly what you want to have in the disqualification message. If in your case you need "Cancelled by validation rules. " then you can use the following regex for the extraction :

disQualificationMessage\=(?<disQualificationMessage>[^\.]+)

You can use this run anywhere search to test it out:

| makeresults 
| eval A="messageTypeKey=CM0001 ,disQualificationMessage=Cancelled by validation rules. SafeTimeNoPhoneHasNoEmail" 
| rex field=A "disQualificationMessage\=(?<disQualificationMessage>[^\.]+)"

Try this for the search in your comment:

source=" " status="Cancelled" | rex field=_raw "disQualificationMessage\=(?<disQualificationMessage>[^\.]+)"| table messageTypeKey,disQualificationMessage

Cheers,
David

Re: Table view

niketn — Mon, 22 Jul 2019 15:28:57 GMT

@venkat0896 you can use regular expression to perform field extraction as per your needs. Try the following rex command:

|  rex "disQualificationMessage=(?<disQualificationMessage>[^\.]+)\.\sSafeTimeNoPhoneHasNoEmail"

Following is a run anywhere example based on your sample data:

|  makeresults
|  eval _raw="messageTypeKey=CM0001 ,disQualificationMessage=Cancelled by validation rules. SafeTimeNoPhoneHasNoEmail" 
|  rex "disQualificationMessage=(?<disQualificationMessage>[^\.]+)\.\sSafeTimeNoPhoneHasNoEmail"