Splunk Search

Extracting a result using regex and feeding that output as an input to get further results?

anushamkrishna
New Member

Hi,

I have a query xapi "GET /xapi/playchannel/" which queries the logs and gives me the result as given below:

"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46524/857 HTTP/1.1"
"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46254/110 HTTP/1.1" and so on..

In the above results the digits 46254,46524 are the device ids and the digits 857,110 are the list of channels that is being tuned in the particular device.

Now, My requirement is I need to make a list of deviceIds first and then on click of the deviceID I need to get the list of channels that is being tuned for that particular deviceID. How to achieve this??

It will be great if someone provides me the splunk query to do this.

Tags (3)
0 Karma

anushamkrishna
New Member

Hi,

Thanks for the reply. Your answer had met my requirement. 🙂

0 Karma

Simeon
Splunk Employee
Splunk Employee

This sounds like two different searches, but I suspect you just want a chart sorted by device and channel. A form search would probably be ideal for your application. The following search should give you a listing of channels by device:

sourcetype=your_sourcetype | rex "GET\s/\S+/\S+/(?<device_id>/S+)\/(?<channel>/S+)/s" | chart count by device_id, channel
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...