How to trim Splunk logs to get time and particular...

kkanand · ‎10-25-2022

Hello

I am having the following query:

index=* "There was an error trying to process" | table _raw

logs

_raw

1	2022-10-25 22:10:59.937 ERROR 1 --- [rTaskExecutor-1] c.s.s.service.InboundProcessingFlow : There was an error trying to process PPositivePay121140399F102520220942.20221025094304862.ach from Inbox.
2	2022-10-25 22:10:57.824 ERROR 1 --- [rTaskExecutor-1] c.s.s.service.InboundProcessingFlow : There was an error trying to process FPositivePay121140399Q102420222215.20221024221617018.ach from Inbox.
3	2022-10-25 22:10:57.824 ERROR 1 --- [rTaskExecutor-2] c.s.s.service.InboundProcessingFlow : There was an error trying to process FPositivePay121140399W102520220113.20221025011346442.ach from Inbox.
4	2022-10-25 22:11:53.729 ERROR 1 --- [rTaskExecutor-2] c.s.s.service.InboundProcessingFlow : There was an error trying to process PPositivePay121140399Q102420222215.20221024221617018.ach from Inbox.

I would need to alter the search query so that the output is becoming:

Time file_name

Thanks

kkanand · ‎10-26-2022

I dont want the "from inbox" to show up in the field
Just

_time message

gcusello · ‎10-25-2022

you have to add _time to your table command

index=*  "There was an error trying to process" 
| table _time _raw

Ciao.

Giuseppe

kkanand · ‎10-25-2022

Dashboard

I want it like this

gcusello · ‎10-25-2022

sorry, but the _raw of the two screenshots are different: you don't want _raw, but a part of it.

in this case yu have to extract a part of _raw using a regex, in this case you can try something like this:

index=*  "There was an error trying to process" 
| rex "There was an error trying to process (?<message>.*)"
| table _time message

Ciao.

Giuseppe

How to trim Splunk logs to get time and particular field?