Splunk Enterprise

Combine rex field

DougiieDee
Explorer

how do i combine both these rex field into one and display the count?

index=abc
"exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by ABC_CODE, Message

index=abc
ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code, Message

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DougiieDee 

Can you please try this?

index=abc ("exception":"CommonApplicationException" OR ABC-*)
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE_1>[^\:]+)\:(?<Message_1>[^\"]+)"
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 
| eval ABC_CODE=if(isnotnull(ABC_CODE_1),ABC_CODE_1,ABC_CODE_2)
| eval Message=if(isnotnull(Message),Message_1,Message_2)
| where ABC_CODE!=""
| stats count by ABC_CODE, Message

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

DougiieDee
Explorer

The results are only showing from this 

|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 

other rex field didnt show the results.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DougiieDee 

Can you please expand timerange if possible?

Meanwhile can you please share sample events from both search?

 

0 Karma

DougiieDee
Explorer

1. {\"errors\":[{\"code\"\"ABC-1000\",\"message\"\"Sorry we are unable to process your request.

index=abc  ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorryit looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...