Splunk Search

Help on Data Aggregation from Logs

viruvaibhav21
New Member

Hi Team,

I am new to Splunk tool. But going through vast documentation also din't help me much.
If someone can help me to know that how to achieve below out put from logs, would really be helpful.

Below raw is just one sample from logs. So i need to have as many rows as we have objectCount.

Raw Output Logs:
<135>Jul 22 01:15:42 ******.nsroot.net {"datetime":"2016-07-22T05:14:40.292Z","apiName":"XYZ","apiVersion":1,"appName":"ABC","envName":"External-ADP","planName":"LMN","planVersion":1,"timeToServeRequest":922,"bytesSent":209,"requestProtocol":"https","requestMethod":"GET",requestTimestamp : 2016-07-22T01:14:39-04:00,responseTimestamp : 2016-07-22T01:14:40-04:00,X-Content-Type-Options : nosniff","responseBody":"","latency":"Initialization=0ms : Start=6ms : 576197e8e4b0d8a5ff967ffc=1ms : 576197e8e4b0d8a5ff967fff=3ms : 56f18e6ee4b06bb8f1889f36=0ms : 1326652068303=2ms : Activity Log 5=0ms : Request=1ms : HTTP GET Operation 5=38ms : HTTP POST Operation 8=519ms : HTTP PUT Operation 2=138ms : HTTP POST Operation 5=139ms : Response=75ms"}

REQUIRED OUTPUT
APIName = XYZ
timeToServeRequest = 922
Start = 6ms

Appreciate your help and response.

Tags (2)
0 Karma

JDukeSplunk
Builder

The first thing you are going to need to do is to extract the fields. If this is in XML/JSON format, you might be able to simply use |spath

base search |spath

Otherwise you will have to use the field extractor, and try to tease out the data you need.
http://docs.splunk.com/images/9/9d/CIM-extract_fields_UI.png

Or you can play around with inline extractions using |rex

| rex field=_raw "apiName":"(?<API_Name>./w+^") 

Then once you get it extracted you can do something like this.

    base search 
| rex field=_raw "apiName":"(?<API_Name>.\w+) "
| rex field=_raw "Start=(?<Start>\d+)"
| stats list(API_Name) by Start

I've not tested any of these regex's. It takes a bit of practice to get them right, but once you have the fields extracted, then you can do more with the data.

Check out the documentation on extracting fields.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...