topic Re: How to extract more number of strings under the same field name? in Splunk Search

How to extract more number of strings under the same field name?

Madhan45 — Fri, 17 Jul 2015 12:02:35 GMT

my event is - "common.exceptions.CommandFailedAtServerException:
concurrent.ExecutionException:
common.SocketPoolException: Unable to connect socket ... 3 lines omitted: java.net.ConnectException: Connection refused ... 8 lines omitted ... common.exceptions.CommandFailedException: "

i want to extract strings "CommandFailedAtServerException, ExecutionException, SocketPoolException java.net.ConnectException CommandFailedException" from the above event under the single filed?

How can i do that?

Re: How to extract more number of strings under the same field name?

woodcock — Fri, 17 Jul 2015 14:48:05 GMT

Like this:

| rex max_match=0 "(?im).*?(?<Exceptions>[\S]*Exception[\S]*)"

Re: How to extract more number of strings under the same field name?

Madhan45 — Mon, 20 Jul 2015 03:12:56 GMT

Hi woodcock.. thats really great... could u explain me the logic?

Re: How to extract more number of strings under the same field name?

woodcock — Mon, 20 Jul 2015 04:06:42 GMT

The rex command takes the _raw field and applies the RegEx to it as many times as possible (max_match=0). The i is for ignore case and the m is for multiline. we skip as few characters as possible to get to non-whitespace characters that end with "Exception" followed by as many non-whitespace characters as possible (this creates the whitespace boundaries) and we call that captured string Exceptions.

Re: How to extract more number of strings under the same field name?

Madhan45 — Mon, 20 Jul 2015 10:23:39 GMT

great.. thanks a ton

Re: How to extract more number of strings under the same field name?

Madhan45 — Mon, 20 Jul 2015 10:44:21 GMT

And one more question. I have two source files and they are containing following fields
1.source=Order, fields= Key,Name,Product,Price
2.source=Delivery, fields=Key,Shipdat,delivery location,price,

The data which comes under "Delivery" should fall under "delivered" category for that i have used this join query ""source="Delivery.csv"| eval status="Delivered"|join Key [source=order.csv|]"" and i got the result.

So how to use the join query for the category "Not delivered"

Re: How to extract more number of strings under the same field name?

woodcock — Thu, 30 Jul 2015 16:11:40 GMT

Try this:

source="Delivery.csv" OR source="order.csv" | stats values(*) AS * BY Key | where isnull(delivery)

If that doesn't do it, ask a new question in the forum.