Archive
Highlighted

Extracting from log file

Communicator

I have the following custom log file

2016-07-1505:58:57.5857-est label="adbcf" lastmodifiedtime="2016-07-1505:58:57.5857-est" filename="13948.xml" directory="d:\temp" operation="deleted" sizeinbytes=434493
2016-07-1517:57:18.5718-est monitorlabel="abcd" lastmodifiedtime="2016-07-1517:57:18.5718-est" filename="late123" directory="d:\temp" operation="created" sizein_bytes=673639

I am able to ingest into Splunk, however when i search for operation="deleted" i did not get the result.
when i search with "deleted" i am able to get the result. operation="created" returns results.
In the interesting field it only shows "created" value for operation even though both created and deleted are present in the results.

Is there anything that could be done in the custom log differently to make Splunk include the "deleted"
| timechart span=1h count by operation gives only created and ignores deleted.

Thanks in advance.

0 Karma
Highlighted

Re: Extracting from log file

Champion

I am not sure, but, pls search using the index name...

index=indexname "created"

0 Karma
Highlighted

Re: Extracting from log file

Legend

You could extract it in your search

    ... |  rex "operation=\"(?<operation>\w+)" | timechart span=1h count by operation

You could also add this rex in the Field Extraction UI to make this field available to every search.'

Highlighted

Re: Extracting from log file

Communicator

index=... | rex "operation=\"(?\w+)" | table operation returns - created only eventhough deleted is present.

0 Karma
Highlighted

Re: Extracting from log file

Communicator

One more information i want to share. Since the logs are generating at the same time will it have any effect?

7/15/16
9:44:52.445 PM

2016-07-1521:44:52.4452-est monitorlabel="aaai" lastmodifiedtime="2016-07-1521:44:52.4452-est" filename="late3.new" directory="d:\tesb11" operation="created" sizeinbytes=9457
2016-07-15
09:44:52.4452-est monitorlabel="sssi" lastmodifiedtime="2016-07-1509:44:52.4452-est" filename="113626.xml" directory="d:\testemp" operation="deleted" sizeinbytes=316005

0 Karma
Highlighted

Re: Extracting from log file

Legend

Try this regex then

 ... |  rex "(?<operation>deleted|created)" | timechart span=1h count by operation
0 Karma
Highlighted

Re: Extracting from log file

Communicator

Please try the following rex command:

| rex max_match=0 "operation=\"(?<operation>[^\"]*?)\""

Do you still have one result with a multivalue "operation" field?

0 Karma
Highlighted

Re: Extracting from log file

Communicator

I was able to figure out the rex. The following works! Thanks everyone.

rex field=_raw "(?ms)^(?:[^\"\n]*\"){9}(?P\w+)"

0 Karma