- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to fetch different record Cache number from single log
Hi Team,
I have below raw logs:
ReadFileImpl - Total number of records details processed for file: TRIM.UNB.D082423.T065617 is: 20516558 with total number of invalid record count: 0 - Data persisted to cache : 13169530
ReadFileImpl - Total number of records details processed for file: TRIM.BLD.D082423.T062015 is: 4043423 with total number of invalid record count: 0 - Data persisted to cache : 3388398
I wan to fetch the highlighted record counts along with file name.
My current query:
index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Data persisted to cache "
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @aditsss,
let me understand: you wnat the regexes to extract values from the shared logs to use in thesearch, is it correct?
If this is yur requirement, please try this regex:
| rex "Total number of records details processed for file: (?<file>[^ ]*)\s+is:\s+(?<total_records_count>\d+) with total number of invalid record count: (?<invalid_record_count>\d+) - Data persisted to cache : (?<cache>\d+)"
That you can check at https://regex101.com/r/uSU7Tv/1
I could be more sure if you could share your full logs and nor only a part of them.
Ciao.
Giuseppe
