Splunk Search

How do I display a table with the fields extracted from regex?

Engager

I built a regular expression to extract fields from a log file. However, after extracting I am not able to display the extracted fields in table format. The regular expression seems to be working online. https://regex101.com/r/ZcYOhG/2

I want to display the extracted fields in a table format. Can someone help me?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

try this:

index=<your_index>
| rex field=_raw "transactionId=(?<transactionId>[^\}]+)\}.*ResourceId\:\s(?<featureName>[^\,]+),.*CPNYID_(?<companyId>\d+)_AID_(?<aPaymentId>\d+)" 
| stats count by aPaymentId companyId featureName transactionId

View solution in original post

SplunkTrust
SplunkTrust

try this:

index=<your_index>
| rex field=_raw "transactionId=(?<transactionId>[^\}]+)\}.*ResourceId\:\s(?<featureName>[^\,]+),.*CPNYID_(?<companyId>\d+)_AID_(?<aPaymentId>\d+)" 
| stats count by aPaymentId companyId featureName transactionId

View solution in original post

Engager

Thank you for the quick reply. It worked well.
Can you explain why the same regex did not worked in splunk as is.
You made little tweaks in the expression.

0 Karma

SplunkTrust
SplunkTrust

whats the query you are using to display the fields in table format?

0 Karma