topic Re: Need REX Help - Table results in Splunk Search

Need REX Help - How do I table results?

kc_prane — Wed, 03 Aug 2022 16:32:41 GMT

Hello, when i table the results the results are not matching exact with the next columns. what can i add to reslove this issue. Please find the below screenshot for the results.

|rex field=_raw "(TEST_DETAIL_MESSAGE\s\=)(?<MESSAGE>\w+\D+\,)" max_match=0 |rex field=_raw "(TEST_COUNT\s\=)(?<COUNT>\s\d+)" max_match=0
| table MESSAGE COUNT

Re: Need REX Help - Table results

gcusello — Wed, 03 Aug 2022 16:31:37 GMT

Hi @kc_prane,

could you share some sample of your logs?

Ciao.

Giuseppe

Re: Need REX Help - Table results

kc_prane — Wed, 03 Aug 2022 18:10:25 GMT

Hi Gcusello - thaks for the response. Please find the belwo log.

Detail_Message, COUNT

TEST_DETAIL_MESSAGE =Person with given Individual Id doesn't exist, TEST_COUNT = 28340 TEST_DETAIL_MESSAGE =could not extract ResultSet; SQL [n/a]; nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet, TEST_COUNT = 301 TEST_DETAIL_MESSAGE =No entity found for query, TEST_COUNT = 59

TEST_DETAIL_MESSAGE =Search Query Processing error org.springframework.orm.jpa.JpaSystemException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls, TEST_COUNT = 60

TEST_DETAIL_MESSAGE =Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls, TEST_COUNT = 501

Re: Need REX Help - Table results

yuanliu — Thu, 04 Aug 2022 03:39:04 GMT

I am a little confused as to what you need diagnosis for, but based on the samples, you shouldn't need rex to begin with. Have you tried extract (aka kv)?

| kv pairdelim="," kvdelim="="

should give you

TEST_COUNT	TEST_DETAIL_MESSAGE	_raw
28340	Person with given Individual Id doesn't exist	TEST_DETAIL_MESSAGE =Person with given Individual Id doesn't exist, TEST_COUNT = 28340
301	could not extract ResultSet; SQL [n/a]; nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet	TEST_DETAIL_MESSAGE =could not extract ResultSet; SQL [n/a]; nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet, TEST_COUNT = 301
59	No entity found for query	TEST_DETAIL_MESSAGE =No entity found for query, TEST_COUNT = 59
60	Search Query Processing error org.springframework.orm.jpa.JpaSystemException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls	TEST_DETAIL_MESSAGE =Search Query Processing error org.springframework.orm.jpa.JpaSystemException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls, TEST_COUNT = 60
501	Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls	TEST_DETAIL_MESSAGE =Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls; nested exception is org.hibernate.HibernateException: Found shared references to a collection: com.ltss.common.transition.model.TnsRqst.tnsAddrDtls, TEST_COUNT = 501

Re: Need REX Help - Table results

gcusello — Thu, 04 Aug 2022 06:58:05 GMT

Hi @kc_prane,

both the regexes are correct and extract the string.

In my environment values are correctly extracted and aligned.

probably the strings you shared are all in the same event and must be separated, could you share your full search, to understand why alignment isn't correct for you?

Ciao.

Giuseppe

Re: Need REX Help - Table results

kc_prane — Fri, 05 Aug 2022 20:56:09 GMT

Hi gcusello - Yes all the lines are for the same event how do i seperate them they about 60 lines. this is an .csv file.

Re: Need REX Help - Table results

kc_prane — Fri, 05 Aug 2022 21:14:41 GMT

Hi yuanliu - Thanks for the response. Can you please provide the exact query. you results looks good

Re: Need REX Help - Table results

yuanliu — Sat, 06 Aug 2022 04:10:59 GMT

I initially thought you had one line per event. If the entire CSV is one event, try this

Re: Need REX Help - Table results

gcusello — Sun, 07 Aug 2022 14:43:26 GMT

Hi @kc_prane,

you should better analyze your data, maybe it's better to have an event for each line, or it's better to separate lines.

could you share your full search, to understand why alignment isn't correct for you?

Ciao.

Giuseppe