Getting Data In

How to edit my regular expression to select the timestamp and UniqueID in order to create a line graph from it?

sankarms
Explorer

I'm trying to create a line graph that represents number of requests throughout the day so we can see when we get the most requests. Here's what the log file looks like:

--69036a3a-A--
[27/Oct/2016:14:43:50 --0700] WBJ1FtFyTFUAABdj928AAADJ 
--69036a3a-B--

That contains the [Timestamp] UniqueId. I want to build the graph with the timestamp and then have a drilldown to show what the unique Id if you want to look at a particular request. I wrote this regex:

\W{2}\d{5}\w\d\w\W[A-B]\W{2}

But this selects --69036a3a-A-- and --69036a3a-B-- whereas I want it to select what's in between. How do I select that and create a line graph out of it?

Edit 1: I modified my regex to make it simpler:

[A]\W{2}\n(.*)\n\-\-

But this selects

A--
 [27/Oct/2016:14:43:50 --0700] WBJ1FtFyTFUAABdj928AAADJ 
 --

Whereas I want to exclude the A-- and --

0 Karma
1 Solution

sshelly_splunk
Splunk Employee
Splunk Employee

If using this in props.conf to extract field named "uniqueID"
Use this: (?ism)\[.+]\s+(?P<uniqueID>\S+)
To do this in search bar, use:
Your search ... | rex field=_raw "(?ism)\[.+]\s+(?P<uniqueID>\S+)"

Remove single tic marks for each example above.

View solution in original post

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

If using this in props.conf to extract field named "uniqueID"
Use this: (?ism)\[.+]\s+(?P<uniqueID>\S+)
To do this in search bar, use:
Your search ... | rex field=_raw "(?ism)\[.+]\s+(?P<uniqueID>\S+)"

Remove single tic marks for each example above.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...