topic Re: How to extract AppId from whole text in Splunk Search

How to extract AppId from whole text

jw44250 — Thu, 06 Apr 2017 21:37:12 GMT

Extracting AppID(s) from whole text and group by AppId and host

txid:944::appId:3::test:

txid:944::appId:3::tes2:

txid:944::appId:4::test4:

txid:944::appId:4::tes2:

txid:944::appId:5::test4:

txid:944::appId:6::tes2:

DalJeanis — Thu, 06 Apr 2017 22:15:23 GMT

Try something like this...

| rex "txid:(?<txid>[^:]+)::appId:(?<appId>[^:]+)::(?<host>[^:]+):"
| stats count by appId host txid

jw44250 — Fri, 07 Apr 2017 06:13:18 GMT

clientAppId="123123"

jw44250 — Fri, 07 Apr 2017 06:13:19 GMT

clientAppId="123123"

jw44250 — Fri, 07 Apr 2017 06:22:20 GMT

| rex "clientAppId(?[^=]+)"
| stats count by appId host

| rex "clientAppId=(?\d+)"
| stats count by appId host

i am not getting any result