topic Re: Fetch the details in Splunk Search

Fetch the details

svodela — Tue, 02 Jan 2024 10:58:27 GMT

We are trying to create a dashboard to understand the usage of our application version something like shown below

Application Name	Version
sgs	1.0.18

When we search for particular index ""sgs1.0.18*" source="/data/wso2/api_manager/current/repository/logs/wso2carbon.log" we get below result.

<< uri="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", SERVICE_PREFIX="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", path="get api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106", resourceMethod="get", HTTP_METHOD="get", resourceUri="api/mydetails/1.0.0/apime/employee-details?correlation-sit=sgs1.0.18u%26h%3d106"

Could you please help us to give sample splunk query to achieve the results .

Thanks

Re: Fetch the details

gcusello — Tue, 02 Jan 2024 12:05:12 GMT

Hi @svodela,

if you're sure that you applications haven't numbers in their name and that version is always in the format "nn.nn.nn", you could use a regex like the following to extract apps and versions and run a search like the following:

<your_search> | rex "correlation-sit=(?<app>[A-Za-z]+)(?<version>\d+\.\d+\.\d+)" | table app version

you can check the regex at https://regex101.com/r/FNieNJ/1

Ciao.

Giuseppe

Re: Fetch the details

svodela — Tue, 02 Jan 2024 13:08:07 GMT

Thank you Giuseppe. Appreciate your support. This query has helped us to do what we are looking for.

Re: Fetch the details

gcusello — Tue, 02 Jan 2024 13:12:52 GMT

Hi @svodela,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Fetch the details

svodela — Tue, 02 Jan 2024 13:17:20 GMT

Hello @gcusello ,

Sorry to come back , is there any way to change the table label.

example of my search:

"sgs1.0.*" source="/data/wso2/api_manager/current/repository/logs/wso2carbon.log" | rex "correlation-sit=(?<app>[A-Za-z]+)(?<version>\d+\.\d+\.\d+)" | table app version userId date_mday| dedup userId | sort version

can my table looks like below

app	version	userid	Date ( rather than date_mday)

Re: Fetch the details

svodela — Tue, 02 Jan 2024 15:26:29 GMT

@gcusello - I was able to fine the way with rename

Re: Fetch the details

dtburrows3 — Tue, 02 Jan 2024 13:36:11 GMT

Add this line to the end of the query

| rename date_mday as Date