Getting Data In

How to use pipeline to get results which match the timestamp?

New Member

Hi All,

I have a particular situation in which two logs lines which are related, have only the timestamp in common, I would like to filter them out. Any help would be appreciated. Here are the details:

Log line 1: 2017-06-06 05:42:04,098 902303596 INFO n.n.f.b.i.s.DefaultSignedUrlFactory - resource images/123456-789/123456-789-PV_JPG_HEI_300.JPG can be accessed via

Log line 2: 2017-06-06 05:42:04,098 902303591 INFO n.n.f.b.c.l.LoggingInterceptor - (N/A) - RETAILER
referrer: N/A
request: /images/v1/123456-789-PV?hei=300&fmt=jpg&qlt=70,1&printRes=72
response code: 302

I would need a query which can filter these two results to extract the line in Italics. Its a very busy server and each second 100's of lines of logs would be printed.

Any advice would be highly appreciated.


0 Karma

Super Champion

you can use something like:

...|rex field=_raw "(?<timestamp>^[0-9-:\s]+)|\n(?<email>.*\))"|stats values(email) as email by timestamp

assuming that email was what you had wanted extracted. that's what looked to be in italics, to me.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...