Splunk Search

Combining the result

Jananee_iNautix
Path Finder

I have a two log statements containing same information in different format as follows

dbg.log:2013-12-09 17:52:12,435 [e8c8] SUCCESS: File successfully uploaded using SFTP. Filename was [nv_afis_nav_download12092013145008.csv]. File length was [1403].
sadm.log:2013-12-20 09:36:35,575 [468a] SUCCESS: File successfully uploaded using FTP. Filename [abc.txt]. File length [5366] bytes.

and I want the filename and filelength to searched and displayed in table.Through the following two searches i extracted the field filename and filelength
Search 1:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length\s(?<filelength>\S+)\sbytes."| table filename filelength

Search 2:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length  was\s(?<filelength>\S+)."| table filename filelength

I want the results of these two searches to be combined.i tried with append,appendcols and join but no luck.Can anyone help me on this to get result in single table.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I would propose a slightly shorter version;

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded 
|rex "\s\[(?<filename>[^\]]+)\.\sFile length (was\s)?\[(?<filelength>[^\]]+)"
| table filename filelength

Should work with having the "was " part of the string as optional. However, it might be worth having two different sourcetypes (one for each log file), if there are more fields you need to extract. This becomes even more true if the log file formats have greater differences than shown in your sample.

/K

View solution in original post

kristian_kolb
Ultra Champion

I would propose a slightly shorter version;

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded 
|rex "\s\[(?<filename>[^\]]+)\.\sFile length (was\s)?\[(?<filelength>[^\]]+)"
| table filename filelength

Should work with having the "was " part of the string as optional. However, it might be worth having two different sourcetypes (one for each log file), if there are more fields you need to extract. This becomes even more true if the log file formats have greater differences than shown in your sample.

/K

MuS
SplunkTrust
SplunkTrust

Hi Jananee_iNautix,

why do you run two searches? you can use two regex's in one search like this:

sourcetype="RSBA_LOGS-2" SUCCESS: File successfully uploaded | rex "s(?<dbg_filename>S+).sFile lengths(?<dbg_filelength>S+)sbytes." | rex "s(?<sadm_filename>S+).sFile length wass(?<sadm_filelength>S+)." | table dbg_filename dbg_filelength sadm_filename sadm_filelength

I just took your searches and edited them to the new one, so this is based on the assumption that those regex's and searches worked before.

hope this helps to get you started ...

cheers, MuS

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...