Splunk Search

Combining the result

Jananee_iNautix
Explorer

I have a two log statements containing same information in different format as follows

dbg.log:2013-12-09 17:52:12,435 [e8c8] SUCCESS: File successfully uploaded using SFTP. Filename was [nv_afis_nav_download12092013145008.csv]. File length was [1403].
sadm.log:2013-12-20 09:36:35,575 [468a] SUCCESS: File successfully uploaded using FTP. Filename [abc.txt]. File length [5366] bytes.

and I want the filename and filelength to searched and displayed in table.Through the following two searches i extracted the field filename and filelength
Search 1:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length\s(?<filelength>\S+)\sbytes."| table filename filelength

Search 2:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length  was\s(?<filelength>\S+)."| table filename filelength

I want the results of these two searches to be combined.i tried with append,appendcols and join but no luck.Can anyone help me on this to get result in single table.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I would propose a slightly shorter version;

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded 
|rex "\s\[(?<filename>[^\]]+)\.\sFile length (was\s)?\[(?<filelength>[^\]]+)"
| table filename filelength

Should work with having the "was " part of the string as optional. However, it might be worth having two different sourcetypes (one for each log file), if there are more fields you need to extract. This becomes even more true if the log file formats have greater differences than shown in your sample.

/K

View solution in original post

kristian_kolb
Ultra Champion

I would propose a slightly shorter version;

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded 
|rex "\s\[(?<filename>[^\]]+)\.\sFile length (was\s)?\[(?<filelength>[^\]]+)"
| table filename filelength

Should work with having the "was " part of the string as optional. However, it might be worth having two different sourcetypes (one for each log file), if there are more fields you need to extract. This becomes even more true if the log file formats have greater differences than shown in your sample.

/K

MuS
SplunkTrust
SplunkTrust

Hi Jananee_iNautix,

why do you run two searches? you can use two regex's in one search like this:

sourcetype="RSBA_LOGS-2" SUCCESS: File successfully uploaded | rex "s(?<dbg_filename>S+).sFile lengths(?<dbg_filelength>S+)sbytes." | rex "s(?<sadm_filename>S+).sFile length wass(?<sadm_filelength>S+)." | table dbg_filename dbg_filelength sadm_filename sadm_filelength

I just took your searches and edited them to the new one, so this is based on the assumption that those regex's and searches worked before.

hope this helps to get you started ...

cheers, MuS

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...