topic How to search results and present as a table of selected key vaule? in Splunk Search

How to search results and present as a table of selected key vaule?

padrsri — Wed, 02 Nov 2022 20:14:21 GMT

Hello All,

The log has empty space before and after equal with semicolon separation. I’m unable to get the table request status like index="gd" RequestStatus | table RequestStatus, _time

Would you please advise if anyone have suggestions

Log sample

{"timestamp":"2022-11-02 17:01:21,421+0000","level":"INFO","location":"request_process:171","message":"request_id = 5ac3565f-d964-31cd-90b1-e8b7b208e7df; RequestStatus = Completed; RequestID = 5ac3565f-d9a64-31cd-9021-e8b7b208e7df--70ivkG0Td8OBpvWk; S3SourceKey = 1049x7555.xml ; "function_request_id":"b61aa34-f22b-53bc-957e-142456b9b7a5","xray_id":"1-6482a25d-78459fbe07213ee14x4386bd"}

RequestStatus = Received

RequestStatus = Completed

RequestStatus = Error

Re: How to search results and present as a table of selected key vaule

richgalloway — Wed, 02 Nov 2022 18:05:16 GMT

Here's the most straightforward way (IMO). It uses the rex command to extract the RequestStatus field.

index="gd" RequestStatus | rex "RequestStatus = (?<RequestStatus>\S+)" | table RequestStatus, _time

Re: How to search results and present as a table of selected key vaule

padrsri — Wed, 02 Nov 2022 19:36:47 GMT

Thank you for quick response and the solutions helped us.

Somehow, I’m not able to get Received request Id in search (sample log). Also is there any way to disable as report like below?

RequestStatus status

message: css_request_id = abceesxs-e8cf-383a-81d6-78185430c323; RequestStatus = Received; EnvName = tst111; RequestId = abceesxs-e8cf-383a-81d6-78185430c323--HO1FQtsdshNVf80E; bucket = testbucket; key = DATA.xml; attempts = 1;

Completed status

message: css_request_id = abceesxs-e8cf-383a-81d6-78185430c323; RequestStatus = Completed; RequestID = abceesxs-e8cf-383a-81d6-78185430c323--HO1FQtsdshNVf80E; responseStatusCode = True; platformBuckets = ['css-lpue1-platform-data-application', 'css-lpue2-platform-data-application']; key = DATA.xml; bucket = testbucket; sourceKey = 10497687_DATA.xml ;
service: gwy-Inbound

Search index

index="gd" RequestStatus RequestID | rex "RequestStatus = (?<RequestStatus>\S+)" | rex "RequestID = ?[\S+](?<RequestID>[\S+]*)" | table RequestID, RequestStatus, _time

Report like

RequestID, RequestStatus , _time
-------------------------------------------------
11111111 Received,Completed 2022-11-02 17:01:21
11111112 Received,Completed 2022-11-02 17:01:21
11111113 Received,Completed 2022-11-02 17:01:21
11111114 Received,Error 2022-11-02 17:01:21
11111115 Received,Completed 2022-11-02 17:01:21

Thank you,

Re: How to search results and present as a table of selected key vaule

richgalloway — Wed, 02 Nov 2022 19:39:55 GMT

You have the right idea, but the RequestID regex needs improvement.

index="gd" RequestStatus RequestID | rex "RequestStatus = (?<RequestStatus>\S+)" | rex "RequestID = (?<RequestID>\S+)" | table RequestID, RequestStatus, _time

Re: How to search results and present as a table of selected key vaule

padrsri — Wed, 02 Nov 2022 20:35:27 GMT

Hello Richgalloway,

Thank you for quick response. somehow, I'm not getting request ID for "RequestStatus = Received; EnvName = tst111; RequestId = abceesxs-e8cf-383a-81d6-78185430c323--HO1FQtsdshNVf80E;" .. do i need regex to excluded "EnvName = tst111;"?

Thanks,

Re: How to search results and present as a table of selected key vaule

richgalloway — Wed, 02 Nov 2022 23:50:32 GMT

The RequestID tag is not consistent - sometimes it uses 'D' and sometimes 'd'. This query should handle that.

index="gd" RequestStatus RequestID | rex "RequestStatus = (?<RequestStatus>\S+)" | rex "RequestI[Dd] = (?<RequestID>\S+)" | table RequestID, RequestStatus, _time

Re: How to search results and present as a table of selected key vaule

padrsri — Thu, 03 Nov 2022 13:19:07 GMT

Thank you for all your help, it's is working as expected

Re: How to search results and present as a table of selected key vaule

padrsri — Thu, 03 Nov 2022 13:28:17 GMT

Thank you for all your help. The search is working fine now. Is it possible to display as report like ? Can you please advise

Search index index="mw_ib_prf507" RequestStatus RequestID
| rex "RequestStatus = (?<RequestStatus>\S+)"
| rex "RequestI[Dd] = (?<RequestID>\S+)"
| table RequestID, RequestStatus

Request Id RequestStatus RequestStatusCount

11111111        Received,Completed              2
11111112        Received,Completed              2
11111113        Received,Completed             2
11111114        Received,Error                        2
11111115        Received,Completed             2

11111115 Received 1

Re: How to search results and present as a table of selected key vaule

richgalloway — Fri, 04 Nov 2022 15:59:32 GMT

I'm not sure how to do that. Sorry.