Dashboards & Visualizations

How to fetch the values from logs

aditsss
Motivator

Hi All,

Below is my raw log

2023-08-08 10:25:48.389 [INFO ] [Thread-3] CollateralProcessor - Completed calculating total balances: Opening Balance: 27321564738.9

Closing Balance: 27223794872.86

Age Total Balance: 27223794872.86

Collateral Sum: 27223794872.86

Its coming like this:

4.PNG

I tried with this but no result:

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "CollateralProcessor - Completed calculating total balances:"| rex "CollateralProcessor - Completed calculating total balances: Opening Balance=(?<Opening Balance>)"|table Opening Balance

 

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this one... 

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "CollateralProcessor - Completed calculating total balances:"| rex "Opening Balance:\s(?P<OpeningBalance>\d+)"|table OpeningBalance

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You log has Opening Balance: and NOT Opening Balance=

Also, it looks like you have a multiline event, so you should use (?m) and/or (?s) in your rex regex

m is multiline mode and s is match newlines. 

Please post your SPL code snippets in a CODE tag </>

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...