Rex to create log level fields for info logs?

jackin · ‎03-10-2023

Hi

I want to create log level field for info logs.It should show the status information .

For example the field name status, the field should show the, okay count, information count, etc count.

Please find the logs below

Status: INFORMATION: Description: Beginning GDP Fransaction Script: 01-22-2023-01-13-04-PM

Status: INFORMATION: Description: txt file already exists

Status: INFORMATION: Description: csv file already exists

Status: OK: Description: C:\GDPFransactionScript\Inputs \GDPTestFile.csv copy to USB successful

Status: OK: Description: C:\GDPTransactionScript\Inputs \GDPTestFile.txt copy to USB successful

Status: ERROR: Description: http POST failed:

Status: ERROR: Description: https POST failed:

Status: INFORMATION: Description: End of GDP Transaction Script: 01-22-2023-01-13-04-PM

richgalloway · ‎03-10-2023

This should get you started.

<<your search>>
| rex "Status: (?<log_level>\w+)"
| stats count by log_level

---
If this reply helps you, Karma would be appreciated.

Are you a member of the Splunk Community?