How to fetch keywords from two different logs

[aditsss]

Hi Team,

I have two logs:

ReadFileImpl - ebnc event unbalanced event occurred for filename TRIM.DEMO.D082623.T070035

GfpEbncImpl - statusList detail with status UNBALANCED with description No Source Event found but Destination Event is present.

I want to show data like this:

phrase                                                                                filename                                                       description

ebnc event unbalanced event occurred             TRIM.DEMO.D082623.T070035        No Source Event found but Destination Event is present.

current query:

index="abc" sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Unbalanced"

please guide

[gcusello]

Hi @aditsss,

could you share the full logs?

because with only these two partial logs, there isn't any key to use for correlate them.

Ciao.

Giuseppe

[aditsss]

HI @gcusello these are only complete logs:

ReadFileImpl - ebnc event unbalanced event occurred for filename TRIM.DEMO.D082623.T070035

GfpEbncImpl - statusList detail with status UNBALANCED with description No Source Event found but Destination Event is present.

From the first log I want to fetch like this:

PHRASE                                                                                       FILENAME

ebnc event unbalanced event occurred               TRIM.DEMO.D082623.T070035

For second logs I want to fetch the descrition of UNBALANCED EVENT

  UNBALANCED with description No Source Event found but Destination Event is present.

@gcusello could you please guide

[gcusello]

Hi @aditsss,

the problem is that I don't see any field that can be used to correlate the two events: is there any other part of the logs, e.g. timestamp, ip address, or something else, because with these logs there isn't any common information to use for the correlation.

When you run your search, are thre as results only these two events or also other events?

Ciao.

Giuseppe

[aditsss]

@gcusello 

when I run the below query:

index="abc" sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Unbalanced"

I see these three results:

2023-08-27 07:11:46.885 [INFO ] [Thread-83] ReadFileImpl - ebnc event unbalanced event occurred for filename TRIM.DEMO.D082623.T070035

2023-08-27 07:11:46.885 [INFO ] [Thread-83] GfpEbncImpl - statusList detail with status UNBALANCED with description No Source Event found but Destination Event is present.

2023-08-27 07:11:46.885 [INFO ] [Thread-83] GfpEbncImpl - balancerResponse received - response EventBalancerResponse [aggregateStatus=UNBALANCED, correlationId=null, statusList=[com.amex.fundingplatform.ebnc.response.StatusList@2f6e3e4b]]

[gcusello · Accepted solution]

Hi @aditsss,

is "Thread-83" a common key to correlate events?

if yes, you could try something like this:

index="abc" sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "Unbalanced"
| rex "^[^\[]*\[[^\]]*\]\s+\[(?<key>[^\]]*)"
| rex "ReadFileImpl\s+-\s+(?<PHRASE>.*)\s+for\s+filename\s+(?<FILENAME>.*)"
| rex "GfpEbncImpl - statusList detail with status (?<PHRASE>.*)"
| stats values(PHRASE) AS PHRASE values(FILENAME) AS FILENAME BY key

Ciao.

Giuseppe

[gcusello]

Hi @aditsss,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉