Dashboards & Visualizations

How to fetch different record Cache number from single log

aditsss
Motivator

Hi Team,

I have below raw logs:

ReadFileImpl - Total number of records details processed for file: TRIM.UNB.D082423.T065617 is: 20516558 with total number of invalid record count: 0 - Data persisted to cache : 13169530

ReadFileImpl - Total number of records details processed for file: TRIM.BLD.D082423.T062015 is: 4043423 with total number of invalid record count: 0 - Data persisted to cache : 3388398

I wan to fetch the highlighted record counts along with file name.

My current query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Data persisted to cache "

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

let me understand: you wnat the regexes to extract values from the shared logs to use in thesearch, is it correct?

If this is yur requirement, please try this regex:

| rex "Total number of records details processed for file: (?<file>[^ ]*)\s+is:\s+(?<total_records_count>\d+) with total number of invalid record count: (?<invalid_record_count>\d+) - Data persisted to cache : (?<cache>\d+)"

That you can check at https://regex101.com/r/uSU7Tv/1 

I could be more sure if you could share your full logs and nor only a part of them.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...