All Apps and Add-ons

Not able to extract exact fields.

gajananh999
Contributor

Dear All,

I working on some oracle data logs. So i am able to extract some fields but i am not able to extract some of fields can anybody help on this.

here is my data

17-Jun-2014, 07:42:02 >> General Email > MR: 9 Emails Processed. 0 Success, 9 Failed.

17-Jun-2014, 07:43:01 >> General Fax > CR: 0 Faxes Processed. 0 Success, 0 Failed.

17-Jun-2014, 07:47:02 >> Bulk Report E2b > E: 23 reports processed. 0 success, 0 failed, 23 skipped.

17-Jun-2014, 07:47:02 >> Bulk Report E2b > E: 1 reports processed. 0 success, 0 failed, 1 skipped.

17-Jun-2014, 07:51:11 >> Audit Log Update > "D:\a\s\p.exe AG Audit Log Update Audit Log Update" stopped.

Here i want to extract below fields

1) No of Emails Processed.
2) No of Success
3) No of Failed
4) No of Fax processed
5) No of Reports Processed

Thanks
Gajanan

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search | rex "\s(?<EmailProcessed>\d+) Emails Processed" | rex "\s(?<Success>\d+) (S|s)uccess" | rex "\s(?<Failed>\d+) (F|f)ailed"| rex "\s(?<FaxProcessed>\d+) Faxes Processed"| rex "\s(?<ReportsProcessed>\d+) reports processed"

View solution in original post

lakromani
Builder

Here is how I would do it.

Settings » Fields » Field extractions
Name: ORACLE_Emails-Processed
Sourcetype: Host->ServerIP
Extraction/Transform: MR: (?<ORACLE_Emails-Processed>.*) Emails Processed.

Name: ORACLE_Emails-Success
Sourcetype: Host->ServerIP
Extraction/Transform: Emails Processed. (?<ORACLE_Emails-Success>.*) Success,

Name: ORACLE_Emails-Failed
Sourcetype: Host->ServerIP
Extraction/Transform: Emails Processed. .* Success, (?<ORACLE_Emails-Failed>.*) Failed.

etc

0 Karma

somesoni2
Revered Legend

Try this

your base search | rex "\s(?<EmailProcessed>\d+) Emails Processed" | rex "\s(?<Success>\d+) (S|s)uccess" | rex "\s(?<Failed>\d+) (F|f)ailed"| rex "\s(?<FaxProcessed>\d+) Faxes Processed"| rex "\s(?<ReportsProcessed>\d+) reports processed"

rakesh_498115
Motivator

Hi gajananh999,

you can use the below rex

:\s(?<NoProcessed>\d+)\s(?<Category>[^\.]+)\.\s(?<NoofSuccess>\d+)\sSuccess,\s(?<NoOfFailed>\d)\sFailed\.

Here Category tells Emails Processed. Reports or Faxes Processed.

0 Karma

gajananh999
Contributor

I have to put this into transform.conf file? and how about the 0 success, 0 failed, 1 skipped ?

let me try this in putting into transform.conf file

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...