Splunk Search

Extracting a result using regex and feeding that output as an input to get further results?

anushamkrishna
New Member

Hi,

I have a query xapi "GET /xapi/playchannel/" which queries the logs and gives me the result as given below:

"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46524/857 HTTP/1.1"
"GET /xapi/playchannel/46254/857 HTTP/1.1"
"GET /xapi/playchannel/46254/110 HTTP/1.1" and so on..

In the above results the digits 46254,46524 are the device ids and the digits 857,110 are the list of channels that is being tuned in the particular device.

Now, My requirement is I need to make a list of deviceIds first and then on click of the deviceID I need to get the list of channels that is being tuned for that particular deviceID. How to achieve this??

It will be great if someone provides me the splunk query to do this.

Tags (3)
0 Karma

anushamkrishna
New Member

Hi,

Thanks for the reply. Your answer had met my requirement. 🙂

0 Karma

Simeon
Splunk Employee
Splunk Employee

This sounds like two different searches, but I suspect you just want a chart sorted by device and channel. A form search would probably be ideal for your application. The following search should give you a listing of channels by device:

sourcetype=your_sourcetype | rex "GET\s/\S+/\S+/(?<device_id>/S+)\/(?<channel>/S+)/s" | chart count by device_id, channel
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...