Extracting a result using regex and feeding that output as an input to get further results?

[anushamkrishna]

Hi,

I have a query xapi "GET /xapi/playchannel/" which queries the logs and gives me the result as given below:

"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46524/857 HTTP/1.1"
"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46254/110 HTTP/1.1" and so on..

In the above results the digits 46254,46524 are the device ids and the digits 857,110 are the list of channels that is being tuned in the particular device.

Now, My requirement is I need to make a list of deviceIds first and then on click of the deviceID I need to get the list of channels that is being tuned for that particular deviceID. How to achieve this??

It will be great if someone provides me the splunk query to do this.

[anushamkrishna]

Hi,

Thanks for the reply. Your answer had met my requirement. 🙂

[Simeon]

This sounds like two different searches, but I suspect you just want a chart sorted by device and channel. A form search would probably be ideal for your application. The following search should give you a listing of channels by device:

sourcetype=your_sourcetype | rex "GET\s/\S+/\S+/(?<device_id>/S+)\/(?<channel>/S+)/s" | chart count by device_id, channel