Splunk Search
Highlighted

Get the number from the log with ":" Symbol

Path Finder

I have a log which looks like follows:

||pool-2-thread-1|| INFO  com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 41 

||pool-2-thread-1|| INFO  com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 140

I want to get the sum of the numbers(140+41+..), And I have tried the below query

base search| rex field=_raw "List size\"\:\"(?<size>[^\"]+)" | stats sum(size)

But it returns nothing. Can anyone please suggest me what am doing wrong.

0 Karma
Highlighted

Re: Get the number from the log with ":" Symbol

How about this:

base search
| rex field=_raw "List size:\s(?<size>\d+)"
| stats sum(size)

Here's a working demo based on your data above:
https://regex101.com/r/LifiVU/1/

View solution in original post

Highlighted

Re: Get the number from the log with ":" Symbol

Path Finder

@elliotproebstel how can change the above query if it is the date. For eg: if I contains the log like
||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.listener.OrderJobListener - ORDERJOB: ACTIVE at STARTTIME: 2018-05-07T06:04:46.087Z

and I want to get the value "2018-05-07T06:04:46.087Z"

0 Karma
Highlighted

Re: Get the number from the log with ":" Symbol

How about this:

base search
| rex field=_raw "(?<date>[^ ]+$)"

Here's a demo:
https://regex101.com/r/Y06SsX/1

This regex is collecting everything between the last space and the end of the line and assigning it to a field called date.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.