Dashboards & Visualizations

Why am I Not able to fetch record Count?

aditsss
Motivator

Hi Team,

Below are my raw logs:

2023-08-08 10:25:13.067 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count:   476

2023-08-08 09:56:03.777 [INFO ] [Thread-3] CollateralProcessor - Server side call completed for Collateral with record count:  18541701

I am using below query to fetch the number

 

index="abc" sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-transform/logs/gfp-settlement-transform.log" "Server side call completed for Collateral with record count"| rex "Server side call completed for Collateral with record count :(?<record>\d+)"|timechart span=1d values(record) AS RecordCountdate.PNG

I am not getting record count just date. Can someone guide here

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Regular expressions must be precise.  A misplaced space or two, while insignificant to a human, may make the difference between a matching event and a non-matching event.  Try this rex command in place of the original.

| rex "Server side call completed for Collateral with record count:\s+(?<record>\d+)"

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Regular expressions must be precise.  A misplaced space or two, while insignificant to a human, may make the difference between a matching event and a non-matching event.  Try this rex command in place of the original.

| rex "Server side call completed for Collateral with record count:\s+(?<record>\d+)"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...