topic Re: Splunk rex help in Splunk Search

Splunk rex help

chanukhya — Thu, 26 Jan 2017 15:55:20 GMT

I am trying to count the number of 200 response codes from an access log. can you please help in getting me the output.

26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/A_node/A_Cluster_jvm 117 118 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" B_Cell/B_node/B_Cluster_jvm_2 164 819 200
26/Jan/2017:08:16:33 PST "POST /webservice/services/serviceABC HTTP/1.1" A_Cell/C_node/C_Cluster_jvm_1197 917 200

Log looks like the above. Is it possible to get the output of stats count by each cell, node and and each jvm? I dont need reading the response codes, because i am doing "* * 200" in base search

Re: Splunk rex help

somesoni2 — Thu, 26 Jan 2017 16:03:09 GMT

Try like this

Updated based on new sample data

your base search | rex "^([^\"]+\"){2}\s+[^\/]+\/(?<node>[^\/]+)\/(?<jvm>\S+)\s+.+(?<response_code>\d+)$" | where response_code=200 | stats count by node jvm

Re: Splunk rex help

chanukhya — Thu, 26 Jan 2017 16:41:32 GMT

Thanks for the response, I also have the date and time in the log. Your regex is picking up "Jan". I dont actually care about method or URI. I just need stats by cell, node and jvm.

Re: Splunk rex help

somesoni2 — Thu, 26 Jan 2017 16:45:10 GMT

Try the updated answer (original answer updated).

Re: Splunk rex help

chanukhya — Thu, 26 Jan 2017 16:53:43 GMT

Thanks for the answer. Is there a tool or way to get or learn how to use these regex codes?

Re: Splunk rex help

somesoni2 — Thu, 26 Jan 2017 16:57:33 GMT

You can use following links:

https://answers.splunk.com/answers/79860/where-i-can-learn-regular-expressions-to-use-them-and-to-create-my-own-regex.html

https://docs.splunk.com/Documentation/Splunk/6.5.1/Knowledge/AboutSplunkregularexpressions

http://www.learnsplunk.com/splunk-regex-tutorial.html