topic Re: Splunk SPL in Splunk Search

Splunk SPL- How do I use regex to create an alert?

uagraw01 — Thu, 06 Oct 2022 13:50:35 GMT

Hello Splunker!

I created below regex from the raw events. And I want to create an alert which show the event in one cloumn only.

| rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)" | rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)" | rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)" | rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)" | rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)"

By using all the fields i want one liner column result like . Please let me know how to concate and use makemv command. And if any other approach then please guide me.

ServiceName

Error_Message

OrderNumber

Reason

ResponseTime

Re: Splunk SPL

gcusello — Thu, 06 Oct 2022 06:33:18 GMT

Hi @uagraw01,

you should explore the transpose command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose) that permits to transpose a list of fields from row to column, something like this:

Ciao.

Giuseppe

Re: Splunk SPL

uagraw01 — Thu, 06 Oct 2022 06:41:24 GMT

@gcusello I need a result output as below:

ServiceName: Paypal
Error_Message: Declined payment
OrderNumber: GGTHLL
ResponseTime: 500
Reason: User not registered

Re: Splunk SPL

gcusello — Thu, 06 Oct 2022 06:53:48 GMT

Hi @uagraw01,

I replicated the output you indicated,

to have both the field name in a column and the value in another column you have to use the same search without the last row:

If instead you want "<fieldname>: >fieldvalue>", you have to use a similar search:

<your_search> | rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)" | rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)" | rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)" | rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)" | rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)" | eval ServiceName="ServiceName: ".ServiceName, Error_Message="Error_Message: ".Error_Message, OrderNumber="OrderNumber: ".OrderNumber, ResponseTime="ResponseTime: ".ResponseTime, Reason="Reason: ".Reason | table ServiceName Error_Message OrderNumber ResponseTime Reason | transpose 5 | rename "row 1" AS Value | table Value

Ciao.

Giuseppe

Re: Splunk SPL

uagraw01 — Thu, 06 Oct 2022 09:16:15 GMT

@gcusello I tried some workarounds. And I succeed what I want to achieve, that is highlighted in the yellow.

Re: Splunk SPL

gcusello — Thu, 06 Oct 2022 09:20:38 GMT

Hi @uagraw01,

good for you, but this is a different output than the one you shared.

why my solution doesn't work for you, what's the problem?

tell me if you need more help, otherwise, please accept one answer for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉