Combining the result

[Jananee_iNautix]

I have a two log statements containing same information in different format as follows

dbg.log:2013-12-09 17:52:12,435 [e8c8] SUCCESS: File successfully uploaded using SFTP. Filename was [nv_afis_nav_download12092013145008.csv]. File length was [1403].
sadm.log:2013-12-20 09:36:35,575 [468a] SUCCESS: File successfully uploaded using FTP. Filename [abc.txt]. File length [5366] bytes.

and I want the filename and filelength to searched and displayed in table.Through the following two searches i extracted the field filename and filelength
Search 1:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length\s(?<filelength>\S+)\sbytes."| table filename filelength

Search 2:

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded |rex "\s(?<filename>\S+).\sFile length  was\s(?<filelength>\S+)."| table filename filelength

I want the results of these two searches to be combined.i tried with append,appendcols and join but no luck.Can anyone help me on this to get result in single table.

[kristian_kolb · Accepted solution]

I would propose a slightly shorter version;

sourcetype="RSBA_LOGS-2" SUCCESS:   File successfully uploaded 
|rex "\s\[(?<filename>[^\]]+)\.\sFile length (was\s)?\[(?<filelength>[^\]]+)"
| table filename filelength

Should work with having the "was " part of the string as optional. However, it might be worth having two different sourcetypes (one for each log file), if there are more fields you need to extract. This becomes even more true if the log file formats have greater differences than shown in your sample.

/K

[MuS]

Hi Jananee_iNautix,

why do you run two searches? you can use two regex's in one search like this:

sourcetype="RSBA_LOGS-2" SUCCESS: File successfully uploaded | rex "s(?<dbg_filename>S+).sFile lengths(?<dbg_filelength>S+)sbytes." | rex "s(?<sadm_filename>S+).sFile length wass(?<sadm_filelength>S+)." | table dbg_filename dbg_filelength sadm_filename sadm_filelength

I just took your searches and edited them to the new one, so this is based on the assumption that those regex's and searches worked before.

hope this helps to get you started ...

cheers, MuS