topic Re: Need help in parsing events in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631742#M219426 <P>Hi,</P><P>Below are the sample events</P><P>Event 1 : TRANEND TRANS ABENDS TRN1 ABN1 blah blah<BR />Event 2 : TRANEND CICS_TRAN_Abends CICT1 TRN3 ABN3 blah blah<BR />Event 3 : TRANSUMM CICS_TSUM_Rate CICT1 = * blah blah<BR />Event 4 : TRANDYN TRANS ABENDS TRN2 ABN2 blah blah<BR />Event 5 : SYSTEM CICS_RDSA_MaxFree CICt2 * * blah blah<BR />Event 6 : TRANDYN CICS_TRAN_Abends CICT1 TRN4 ABN4 blah blah</P><P>Events containing below text should be in output. So, Events 2,3,5 need to be excluded from the result<BR />"TRANEND TRANS ABENDS"<BR />"TRANEND CICS_TRAN_Abends"<BR />"TRANDYN TRANS ABENDS"<BR />"TRANDYN CICS_TRAN_Abends"</P><P><BR />I want below output</P><P>Traction Abend code<BR />TRN1 ABN1<BR />TRN3 ABN3<BR />TRN2 ABN2<BR />TRN4 ABN4</P><P><BR />Thanks,<BR />Ravikumar</P> Tue, 21 Feb 2023 17:11:18 GMT ravikumar_sri20 2023-02-21T17:11:18Z How to parse these events? https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631709#M219405 <PRE>Hi Experts,<BR /><BR />I have below events<BR /><BR />Event 1 : TRANEND TRANS ABENDS TRN1 ABN1 blah blah<BR />Event 2 : TRANEND CICS_TRAN_Abends CICT1 TRN3 ABN3 blah blah<BR />Event 3 : TRANSUMM CICS_TSUM_Rate CICT1 = * blah blah<BR />Event 4 : TRANDYN TRANS ABENDS TRN2 ABN2 blah blah<BR />Event 5 : SYSTEM CICS_RDSA_MaxFree CICt2 * * blah blah<BR />Event 6 : TRANDYN CICS_TRAN_Abends CICT1 TRN4 ABN4 blah blah<BR /><BR />I want below output<BR /><BR />Traction Abend code<BR />TRN1 ABN1<BR />TRN3 ABN3<BR />TRN2 ABN2<BR />TRN4 ABN4<BR /><BR />Events 2,3,5 needs to be excluded from the result<BR /><BR />Could you please help me ?<BR /><BR />Thanks,<BR />Ravikumar</PRE> <P>&nbsp;</P> Tue, 21 Feb 2023 18:39:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631709#M219405 ravikumar_sri20 2023-02-21T18:39:46Z Re: Need help in parsing events https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631716#M219407 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/248171">@ravikumar_sri20</a>,</P><P>what are the rules to exclude ot include an event?</P><P>could you share a sample of your events?</P><P>Ciao.</P><P>Giuseppe</P> Tue, 21 Feb 2023 13:09:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631716#M219407 gcusello 2023-02-21T13:09:06Z Re: Need help in parsing events https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631742#M219426 <P>Hi,</P><P>Below are the sample events</P><P>Event 1 : TRANEND TRANS ABENDS TRN1 ABN1 blah blah<BR />Event 2 : TRANEND CICS_TRAN_Abends CICT1 TRN3 ABN3 blah blah<BR />Event 3 : TRANSUMM CICS_TSUM_Rate CICT1 = * blah blah<BR />Event 4 : TRANDYN TRANS ABENDS TRN2 ABN2 blah blah<BR />Event 5 : SYSTEM CICS_RDSA_MaxFree CICt2 * * blah blah<BR />Event 6 : TRANDYN CICS_TRAN_Abends CICT1 TRN4 ABN4 blah blah</P><P>Events containing below text should be in output. So, Events 2,3,5 need to be excluded from the result<BR />"TRANEND TRANS ABENDS"<BR />"TRANEND CICS_TRAN_Abends"<BR />"TRANDYN TRANS ABENDS"<BR />"TRANDYN CICS_TRAN_Abends"</P><P><BR />I want below output</P><P>Traction Abend code<BR />TRN1 ABN1<BR />TRN3 ABN3<BR />TRN2 ABN2<BR />TRN4 ABN4</P><P><BR />Thanks,<BR />Ravikumar</P> Tue, 21 Feb 2023 17:11:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631742#M219426 ravikumar_sri20 2023-02-21T17:11:18Z Re: Need help in parsing events https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631743#M219427 <P>Hi,</P><P>Below are the sample events</P><P>Event 1 : TRANEND TRANS ABENDS TRN1 ABN1 blah blah<BR />Event 2 : TRANEND CICS_TRAN_Abends CICT1 TRN3 ABN3 blah blah<BR />Event 3 : TRANSUMM CICS_TSUM_Rate CICT1 = * blah blah<BR />Event 4 : TRANDYN TRANS ABENDS TRN2 ABN2 blah blah<BR />Event 5 : SYSTEM CICS_RDSA_MaxFree CICt2 * * blah blah<BR />Event 6 : TRANDYN CICS_TRAN_Abends CICT1 TRN4 ABN4 blah blah</P><P>Events containing below text should be in output. So, Events 2,3,5 need to be excluded from the result<BR />"TRANEND TRANS ABENDS"<BR />"TRANEND CICS_TRAN_Abends"<BR />"TRANDYN TRANS ABENDS"<BR />"TRANDYN CICS_TRAN_Abends"</P><P><BR />I want below output</P><P>Traction Abend code<BR />TRN1 ABN1<BR />TRN3 ABN3<BR />TRN2 ABN2<BR />TRN4 ABN4</P><P><BR />Thanks,<BR />Ravikumar</P> Tue, 21 Feb 2023 17:12:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-parse-these-events/m-p/631743#M219427 ravikumar_sri20 2023-02-21T17:12:28Z