How to trim Splunk logs to get time and particular field?

[kkanand]

Hello

I am having the following query: 

index=*  "There was an error trying to process" | table _raw

logs

_raw

1	2022-10-25 22:10:59.937 ERROR 1 --- [rTaskExecutor-1] c.s.s.service.InboundProcessingFlow : There was an error trying to process PPositivePay121140399F102520220942.20221025094304862.ach from Inbox.
2	2022-10-25 22:10:57.824 ERROR 1 --- [rTaskExecutor-1] c.s.s.service.InboundProcessingFlow : There was an error trying to process FPositivePay121140399Q102420222215.20221024221617018.ach from Inbox.
3	2022-10-25 22:10:57.824 ERROR 1 --- [rTaskExecutor-2] c.s.s.service.InboundProcessingFlow : There was an error trying to process FPositivePay121140399W102520220113.20221025011346442.ach from Inbox.
4	2022-10-25 22:11:53.729 ERROR 1 --- [rTaskExecutor-2] c.s.s.service.InboundProcessingFlow : There was an error trying to process PPositivePay121140399Q102420222215.20221024221617018.ach from Inbox.

I would need to alter the search query so that the output is becoming: 

Time                             file_name

2022-10-25 15:10:49	PPositivePay121140399F102520220942.20221025094304862.ach
2022-10-25 15:10:59	FPositivePay121140399Q102420222215.20221024221617018.ach
2022-10-25 15:11:09	FPositivePay121140399W102520220113.20221025011346442.ach
2022-10-25 15:11:14	PPositivePay121140399Q102420222215.20221024221617018.ach

Thanks

@gcusello 

[kkanand]

I dont want the "from inbox" to show up in the field
Just

_time message

2022-10-25 22:11:00.015	PPositivePay121140399F102520220942.20221025094304862.ach
2022-10-25 22:10:57.826	FPositivePay121140399Q102420222215.20221024221617018.ach
2022-10-25 22:10:57.826	FPositivePay121140399W102520220113.20221025011346442.ach
2022-10-25 22:11:53.729	PPositivePay121140399Q102420222215.20221024221617018.ach

[gcusello]

Hi @kkanand,

you have to add _time to your table command

index=*  "There was an error trying to process" 
| table _time _raw

Ciao.

Giuseppe

[kkanand]

Dashboard

I want it like this

[gcusello]

HI @kkanand,

sorry, but the _raw of the two screenshots are different: you don't want _raw, but a part of it.

in this case yu have to extract a part of _raw using a regex, in this case you can try something like this:

index=*  "There was an error trying to process" 
| rex "There was an error trying to process (?<message>.*)"
| table _time message

Ciao.

Giuseppe