Splunk Search

Help with extract data from logs

New Member

Hi I have logs of these events
it contains requestID with some listType

and in response it can contain requestID with recordType

and I need have something like

listType email / 20x B / 13x W
listType phone / 10xB / 11x W

but with one event containing multiple requestID and each can be for different listType not sure how to do it.

    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP-ENV:Header/>
    <SOAP-ENV:Body>
        <ns2:searchResponse xmlns:ns2="http://**********">
            <ns2:records>
                <ns2:requestId>11111111</ns2:requestId>
                <ns2:recordType>B</ns2:recordType>
            </ns2:records>
            <ns2:records>
                <ns2:requestId>2222222</ns2:requestId>
                <ns2:recordType>W</ns2:recordType>
            </ns2:records>
            <ns2:records>
                <ns2:requestId>3333333333333</ns2:requestId>
                <ns2:recordType>W</ns2:recordType>
            </ns2:records>
        </ns2:searchResponse>
    </SOAP-ENV:Body>
</SOAP-ENV:Envelope>] for request [<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
    <env:Header/>
    <env:Body>
        <trl:searchRequest xmlns:trl="http://**********">
            <trl:records>
                <trl:requestId>11111111</trl:requestId>
                <trl:listType>email</trl:listType>
                ....
            </trl:records>
            <trl:records>
                <trl:requestId>3333333333333</trl:requestId>
                <trl:listType>phone</trl:listType>
                .....
            </trl:records>
            ....
        </trl:searchRequest>
    </env:Body>
</env:Envelope>
0 Karma

Splunk Employee
Splunk Employee

2 approaches

0 Karma