Getting Data In

Need help with log having multiple occurrence of same field

abishekmaggo
New Member

I have following logs where field4 is coming twice in each log line.

Example:
2018-04-06T23:01:36.264+0000 logLevel=INFO Response=(( filed1=XXX, field2=ZZZZ), field3=jeSession, field4=abc_xxx, field6=ddd.com, field6=)) field7=service1 field4=xyz_xxx field8=ser1
2018-04-06T23:01:36.264+0000 logLevel=INFO Response=(( filed1=YYY, field2=ZZZZ1), field3=tuSession, field4=abc_yyy, field6=ccc.com, field6=)) field7=service2 field4=xyz_yyy field8=ser2

How I can make sure it always pick first field4 for value (one with value as "acd_xxx", "abc_yyy"). I tried using mvindex but it works with multiple value in field itself (e.g. field4=xxx,yyy)

I want to display count by first field4 only

index=XXXXX | eval res=mvindex(field4,0) | stats count by res

Tags (3)
0 Karma

niketn
Legend

@abishekmaggo, first occurrence of field4 is followed by field6 while the second occurrence of field4 is followed by field8. So maybe you can use that to your advantage.

<yourBaseSearch>
| rex "field4=(?<field4>[^,]+),field6="
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adonio
Ultra Champion

hello there,

i am positive there other ways to solve it, here is a quick one assuming your data looks always like your samples
use the |rex command to point only to your first field4 maybe something like this:

index = XXXXX
| rex "field3=\S+,\sfield4=(?<field4>\S+),"
| stats count by field4

see link:
https://regex101.com/r/uMivWN/1
note: my regex might not be the best one

hope it helps

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...