Dashboards & Visualizations

How to fetch file name from raw logs

aditsss
Motivator

Hi Team,

2023-08-27 10:34:18.285 [INFO ] [Thread-30] TriumphUnbilledProcessor - TRIM.UNBILLED event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

 

2023-08-27 07:38:31.688 [INFO ] [Thread-31] TriumphCancelTransferProcessor - TRIM.CNX event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

I want to fetch filenames(bold) from row logs: TRIM.UNBILLED and TRIM.CNX

my current query:

index="abc"sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "event published to ebnc:" NOT "Utils -" | rex " event published to ebnc: \[\{\"status\":\"(?<status>.*)\",\"description\":\"(?<description>.*)\"\}\]" | eval message="event published to ebnc"
| table message status description

 

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

is the processor word always present?

if yes, please try:

! rex "Processor - (?<field>[^ ]*)"

in other words, you have to find a rule to apply to the regex to identify the part to extract.

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

please try the following regex:

! rex "Triumph.*Processor - (?<field>[^ ]*)"

that you can test at https://regex101.com/r/XNehPc/1

Ciao.

Giuseppe

0 Karma

aditsss
Motivator

@gcusello 

It will not always 

"Triumph.*Processor

CarsUnbilledProcessor - CARS.UNBILLED event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

CarsDeltaHierarchyProcessor - CARS_HIERARCHY event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

2023-08-30 04:30:48.058 [INFO ] [Thread-43] TriumphProductProcessor - TRIM.PRD event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]

Its both CARS and Triumph 

@gcusello can you provide me regex now.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

is the processor word always present?

if yes, please try:

! rex "Processor - (?<field>[^ ]*)"

in other words, you have to find a rule to apply to the regex to identify the part to extract.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...