Splunk Search

Cannot convert a rex pattern variable to use in a chart

gsbpp
Observer

I have the following splunk event:

2020-Jul-30 18:19:02.891Z level=DEBUG thread=https-jsse-nio-2720-exec-9 pid=20 code_location=c.x.p.service.WebhookEventServiceImpl request_id=1fPwftTa2ylVm7CbcwnBirNhhjX trace_id=79d2157d38d3fd37 Processing message event[id=WH-29K757251Y0625428-0EP848134S044830M; resourceType=dispute; paypalDebugId=bac532dd23d05] using routingKey[com.xoom.paypal-events.v1.CUSTOMER.DISPUTE.UPDATED].

1. I want to create a chart that aggregates by resourceType and routingKey.

2. I have the following command

index="myindex" sourcetype="mySourceType" "Processing message event" | rex field=instance "routingKey\[(?<eventType>)\]\s" | chart count by resourceType eventType

3. The result I get is just by resourceType. I am not  able to assign the <eventType> variable to a field name for the chart.splunk chartsplunk chart

 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex command is trying match against the instance field, but that field doesn't exist in the sample event. Try using 

| rex field=_raw ...
---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

your regex for eventType needs fixing. Please try this

\[(?<eventType>[^\]]+)

r. Ismo 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...