Splunk Search

Get the number from the log with ":" Symbol

karthi25
Path Finder

I have a log which looks like follows:

||pool-2-thread-1|| INFO  com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 41 

||pool-2-thread-1|| INFO  com.tmobile.sfdc.reports.service.OpportunityService - OPPORTUNITY_JOB: List size: 140

I want to get the sum of the numbers(140+41+..), And I have tried the below query

base search| rex field=_raw "List size\"\:\"(?<size>[^\"]+)" | stats sum(size)

But it returns nothing. Can anyone please suggest me what am doing wrong.

0 Karma
1 Solution

elliotproebstel
Champion

How about this:

base search
| rex field=_raw "List size:\s(?<size>\d+)"
| stats sum(size)

Here's a working demo based on your data above:
https://regex101.com/r/LifiVU/1/

View solution in original post

elliotproebstel
Champion

How about this:

base search
| rex field=_raw "List size:\s(?<size>\d+)"
| stats sum(size)

Here's a working demo based on your data above:
https://regex101.com/r/LifiVU/1/

karthi25
Path Finder

@elliotproebstel how can change the above query if it is the date. For eg: if I contains the log like
||pool-2-thread-1|| INFO com.tmobile.sfdc.reports.batch.listener.OrderJobListener - ORDER_JOB: ACTIVE at START_TIME: 2018-05-07T06:04:46.087Z

and I want to get the value "2018-05-07T06:04:46.087Z"

0 Karma

elliotproebstel
Champion

How about this:

base search
| rex field=_raw "(?<date>[^ ]+$)"

Here's a demo:
https://regex101.com/r/Y06SsX/1

This regex is collecting everything between the last space and the end of the line and assigning it to a field called date.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...