Dashboards & Visualizations

How to fetch the values from logs

aditsss
Motivator

Hi All,

Below is my raw log

2023-08-08 10:25:48.389 [INFO ] [Thread-3] CollateralProcessor - Completed calculating total balances: Opening Balance: 27321564738.9

Closing Balance: 27223794872.86

Age Total Balance: 27223794872.86

Collateral Sum: 27223794872.86

Its coming like this:

4.PNG

I tried with this but no result:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "CollateralProcessor - Completed calculating total balances:"| rex "CollateralProcessor - Completed calculating total balances: Opening Balance=(?<Opening Balance>)"|table Opening Balance

 

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this one... 

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "CollateralProcessor - Completed calculating total balances:"| rex "Opening Balance:\s(?P<OpeningBalance>\d+)"|table OpeningBalance

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You log has Opening Balance: and NOT Opening Balance=

Also, it looks like you have a multiline event, so you should use (?m) and/or (?s) in your rex regex

m is multiline mode and s is match newlines. 

Please post your SPL code snippets in a CODE tag </>

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...