How to fetch a word from logs

[aditsss]

Hi Team,

Below is my raw log

I want to fetch 38040 from log please guide

ArchivalProcessor - Total records processed - 38040

[ITWhisperer]

| rex "Total records processed - (?<processed>\d+)"

[aditsss]

@ITWhisperer 

I make the below query but my processed count is coming as blank

index="abc" sourcetype=600000304_gg_abs_ipc2 "Total records processed -"
| rex "Total records processed -(?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount

Raw logs

2024-10-23 20:40:23.658 [INFO ] [pool-2-thread-1] ArchivalProcessor - Total records processed - 15618

[ITWhisperer]

Please show your raw event in a codeblock (using the </> button)

[aditsss]

Hi @ITWhisperer 

Raw code

2024-10-29 20:42:43.702 [INFO ] [pool-2-thread-1] ArchivalProcessor - Total records processed - 38040

• host = lgposput50341.gso.aexp.com
• source = /amex/app/abs-upstreamer/logs/abs-upstreamer.log
• sourcetype = 600000304_gg_abs_ipc2

my query:

index="600000304_d_gridgain_idx*" sourcetype=600000304_gg_abs_ipc2 source!="/var/log/messages" "ArchivalProcessor - Total records processed"| rex "Total records processed -(?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount

index="abc" sourcetype=600000304_gg_abs_ipc2 source!="/var/log/messages" "ArchivalProcessor - Total records processed"| rex "Total records processed -(?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount

[ITWhisperer]

What is it that you are trying to chart? The values() aggregate function with give you a multivalue field of strings with unique values from your events for each time bucket. You cannot chart strings on the y-axis, they need to be numbers.

[aditsss]

@ITWhisperer ,

I want to make one table where we have date on one column and counts on other column

[ITWhisperer]

From looking at what you have posted, it appears that there may be a space between the "-" and the start of the number which is not present in the regex. This is why we ask for event data and SPL code to be shared in code blocks, so these things can be more easily spotted. Assuming this is the case, then use the regex as I showed (not as you have apparently used).

[aditsss]

@ITWhisperer 

I tried below query but still not able to fetch record

index="abc" sourcetype=600000304_gg_abs_ipc2 source!="/var/log/messages" "ArchivalProcessor - Total records processed"| rex "Total records processed -(?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount

Please find below raw logs 

2024-10-29 20:39:55.900 [INFO ] [pool-2-thread-1] ArchivalProcessor - Total records processed - 27846 

• host = lgposput50341.gso.aexp.com

• source = /amex/app/abs-upstreamer/logs/abs-upstreamer.log

• sourcetype = 600000304_gg_abs_ipc2

[ITWhisperer]

As I said before, there appears to be a space between "Total records processed -" and 27846 which doesn't appear to have been catered for in your regex

Total records processed - 27846

 Please share the search also in a code block (as above) so we can check.

[aditsss]

Hi @ITWhisperer .

PFB search string in code block

index="abc" sourcetype=600000304_gg_abs_ipc2 source!="/var/log/messages" "ArchivalProcessor - Total records processed"| rex "Total records processed -(?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount

[ITWhisperer]

Exactly what I was saying, you have missed a space between the "-" and the number. Try this:

index="abc" sourcetype=600000304_gg_abs_ipc2 source!="/var/log/messages" "ArchivalProcessor - Total records processed"| rex "Total records processed - (?<processed>\d+)"
| timechart span=1d values(processed) AS ProcessedCount