How to transpose based on regex data to get the counts

kuul13 — Thu, 02 May 2024 23:02:59 GMT

Hi,

I am new to Splunk. I am trying to figure out how to extract count of errors per api calls made for each client.

I have following query that i run :

`index=application_na sourcetype=my_logs:hec source=my_Logger_PROD retrievePayments* ( returncode=Error OR returncode=Communication_Error) | rex field=message "Message=.* \((?<apiName>\w+?) -" | lookup My_Client_Mapping client | table ClientName, apiName'

This query parses message to extract the apinames that starts with `retrievePayments`. And shows this kind of results

ClientName apiName

Client A retrievePaymentsA

Client B retrievePaymentsA

Client C retrievePaymentsB

Client A retrievePaymentsB

I want to see an output where my wildcard apiName are transposed and show error count for every client.

Client retrievePaymentsA retrievePaymentsB retrievePaymentsC retrievePaymentsD

Client A 2 5 0 1

Client B 2 2 1 6

Client C 8 3 0 0

Client D 1 0 4 3

Any help would be appreciated.

Re: How to transpose based on regex data to get the counts

bowesmana — Thu, 02 May 2024 22:37:57 GMT

@kuul13

This is a straightforward use of the chart command, see this run anywhere example

This sets up some example data and then uses the chart command do to the tabling you need.

topic How to transpose based on regex data to get the counts in Splunk Search

How to transpose based on regex data to get the counts

Re: How to transpose based on regex data to get the counts