Splunk Enterprise

Combine rex field

DougiieDee
Explorer

how do i combine both these rex field into one and display the count?

index=abc
"exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| stats count by ABC_CODE, Message

index=abc
ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code, Message

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DougiieDee 

Can you please try this?

index=abc ("exception":"CommonApplicationException" OR ABC-*)
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE_1>[^\:]+)\:(?<Message_1>[^\"]+)"
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 
| eval ABC_CODE=if(isnotnull(ABC_CODE_1),ABC_CODE_1,ABC_CODE_2)
| eval Message=if(isnotnull(Message),Message_1,Message_2)
| where ABC_CODE!=""
| stats count by ABC_CODE, Message

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

DougiieDee
Explorer

The results are only showing from this 

|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_CODE_2>ABC\-\d+)\"\,\"message\"\:\"(?P<Message_2>[^\"]+)" 

other rex field didnt show the results.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@DougiieDee 

Can you please expand timerange if possible?

Meanwhile can you please share sample events from both search?

 

0 Karma

DougiieDee
Explorer

1. {\"errors\":[{\"code\"\"ABC-1000\",\"message\"\"Sorry we are unable to process your request.

index=abc  ABC-*
|rex field=_raw "errors\"\:\[\{\"code\"\:\"(?P<ABC_Code>ABC\-\d+)\"\,\"message\"\:\"(?P<Message>[^\"]+)" | where ABC_Code!="" | search ABC_Code=* | Stats count by ABC_Code Message

2. exception:CommonApplicationException ABC_1001:We're sorryit looks like an error occured

index=abc "exception":"CommonApplicationException"
| rex field=_raw "Exception\:\s(?=ABC)(?<ABC_CODE>[^\:]+)\:(?<Message>[^\"]+)"
| eval Message=substr(Message, 1, 140)
| stats count by ABC_CODE, Message

I have these two rex and want to combine both but because these two are different is it possible to combine them and have Stats count by ABC_Code Message?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...