Dashboards & Visualizations

How to fetch different record Cache number from single log

aditsss
Motivator

Hi Team,

I have below raw logs:

ReadFileImpl - Total number of records details processed for file: TRIM.UNB.D082423.T065617 is: 20516558 with total number of invalid record count: 0 - Data persisted to cache : 13169530

ReadFileImpl - Total number of records details processed for file: TRIM.BLD.D082423.T062015 is: 4043423 with total number of invalid record count: 0 - Data persisted to cache : 3388398

I wan to fetch the highlighted record counts along with file name.

My current query:

index="600000304_d_gridgain_idx*" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Data persisted to cache "

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

let me understand: you wnat the regexes to extract values from the shared logs to use in thesearch, is it correct?

If this is yur requirement, please try this regex:

| rex "Total number of records details processed for file: (?<file>[^ ]*)\s+is:\s+(?<total_records_count>\d+) with total number of invalid record count: (?<invalid_record_count>\d+) - Data persisted to cache : (?<cache>\d+)"

That you can check at https://regex101.com/r/uSU7Tv/1 

I could be more sure if you could share your full logs and nor only a part of them.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...