Getting Data In

How to use pipeline to get results which match the timestamp?

sagarms27
New Member

Hi All,

I have a particular situation in which two logs lines which are related, have only the timestamp in common, I would like to filter them out. Any help would be appreciated. Here are the details:

Log line 1: 2017-06-06 05:42:04,098 902303596 INFO n.n.f.b.i.s.DefaultSignedUrlFactory - resource images/123456-789/123456-789-PV_JPG_HEI_300.JPG can be accessed via https://XXXXXXXX.com/images/XXXXXXXXXX

Log line 2: 2017-06-06 05:42:04,098 902303591 INFO n.n.f.b.c.l.LoggingInterceptor -
abc.def@abcd.com (N/A) - RETAILER
referrer: N/A
request: /images/v1/123456-789-PV?hei=300&fmt=jpg&qlt=70,1&printRes=72
response code: 302

I would need a query which can filter these two results to extract the line in Italics. Its a very busy server and each second 100's of lines of logs would be printed.

Any advice would be highly appreciated.

Regards,
Sagar

0 Karma

cmerriman
Super Champion

you can use something like:

...|rex field=_raw "(?<timestamp>^[0-9-:\s]+)|\n(?<email>.*\))"|stats values(email) as email by timestamp

assuming that email was what you had wanted extracted. that's what looked to be in italics, to me.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...