Splunk Search

Help on Data Aggregation from Logs

viruvaibhav21
New Member

Hi Team,

I am new to Splunk tool. But going through vast documentation also din't help me much.
If someone can help me to know that how to achieve below out put from logs, would really be helpful.

Below raw is just one sample from logs. So i need to have as many rows as we have objectCount.

Raw Output Logs:
<135>Jul 22 01:15:42 ******.nsroot.net {"datetime":"2016-07-22T05:14:40.292Z","apiName":"XYZ","apiVersion":1,"appName":"ABC","envName":"External-ADP","planName":"LMN","planVersion":1,"timeToServeRequest":922,"bytesSent":209,"requestProtocol":"https","requestMethod":"GET",requestTimestamp : 2016-07-22T01:14:39-04:00,responseTimestamp : 2016-07-22T01:14:40-04:00,X-Content-Type-Options : nosniff","responseBody":"","latency":"Initialization=0ms : Start=6ms : 576197e8e4b0d8a5ff967ffc=1ms : 576197e8e4b0d8a5ff967fff=3ms : 56f18e6ee4b06bb8f1889f36=0ms : 1326652068303=2ms : Activity Log 5=0ms : Request=1ms : HTTP GET Operation 5=38ms : HTTP POST Operation 8=519ms : HTTP PUT Operation 2=138ms : HTTP POST Operation 5=139ms : Response=75ms"}

REQUIRED OUTPUT
APIName = XYZ
timeToServeRequest = 922
Start = 6ms

Appreciate your help and response.

Tags (2)
0 Karma

JDukeSplunk
Builder

The first thing you are going to need to do is to extract the fields. If this is in XML/JSON format, you might be able to simply use |spath

base search |spath

Otherwise you will have to use the field extractor, and try to tease out the data you need.
http://docs.splunk.com/images/9/9d/CIM-extract_fields_UI.png

Or you can play around with inline extractions using |rex

| rex field=_raw "apiName":"(?<API_Name>./w+^") 

Then once you get it extracted you can do something like this.

    base search 
| rex field=_raw "apiName":"(?<API_Name>.\w+) "
| rex field=_raw "Start=(?<Start>\d+)"
| stats list(API_Name) by Start

I've not tested any of these regex's. It takes a bit of practice to get them right, but once you have the fields extracted, then you can do more with the data.

Check out the documentation on extracting fields.

https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Extractfieldswithsearchcommands

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...