How do I extract data from logfile while doing search?

[pradiptam]

I have the following type of logfile

TEST_BEG;0;30/12/2015 10:45:16:1000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;1;0;0;;Q:\MYSHOP\PETS\QPXN.TXT

TEST_LOG;0;30/12/2015 10:45:26:3000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;1;1;;;Start of error rows summary
TEST_LOG;0;30/12/2015 10:45:26:3000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTENT/00020 at line #1(26)
TEST_LOG;0;30/12/2015 10:45:29:1000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTLST/00020 at line #1635(8)
TEST_LOG;0;30/12/2015 10:45:33:4000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTLNT/00020 at line #3

02(3)

In the logfile file, we catch all the data loading activities. Now I want to extract the file name " QPXN.TXT" for which I am getting the error, along with the last numbers in each TEST_LOG at the end of each line like here 26, 8, 3.

How do I go about it, do I need to use regular expressions like regex?

[pradiptam]

Hi All,

Thanks to all for your help, i am extracting a particular field using regular expression and also prepared a lookup file with this particular value and the fields which i require from the logfile and running my queries to get the desired results.

Regards,

Pradipta

[mayurr98]

hey if you want all the values in one field then try this

| makeresults | eval raw="TEST_BEG;0;30/12/2015 10:45:16:1000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;1;0;0;;Q:\MYSHOP\PETS\QPXN.TXT,TEST_LOG;0;30/12/2015 10:45:26:3000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;1;1;;;Start of error rows summary,TEST_LOG;0;30/12/2015 10:45:26:3000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTENT/00020 at line #1(26),TEST_LOG;0;30/12/2015 10:45:29:1000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTLST/00020 at line #1635(8),TEST_LOG;0;30/12/2015 10:45:33:4000;1;DSLR5590;MYSHOP;;1139;IMPORT OF THE UPDATED MODIFICATIONS;3;1;;;Error row found for PTLNT/00020 at line #302(3)" | makemv raw delim="," | mvexpand raw | rex field=raw ".*(\\\\|(\/\d+\sat\sline\s#\d+\())(?<filename>((\w+\.\w+)|(\d+)))?"

in your environment, you should write

 <base_search> | rex field=_raw ".*(\\\\|(\/\d+\sat\sline\s#\d+\())(?<filename>((\w+\.\w+)|(\d+)))?"

if you want to extract in different fields then try
for filename

<base_search> | rex field=_raw".*\\\\(?<filename>.*)?"

for position

<base_search> | rex field=_raw ".*at\sline.*\((?<position>\d{1})\)?"

let me know if this helps!

[Elsurion]

For the Number you can use this Regex, assuming that the message itself can alter

|rex field=_raw "TEST_LOG.+\((?<position_number>\d+)\)"

For the Logfile you can use this regex

| rex field=_raw "(\S+\\){0,}(?<error_file>\S+)$"

Can you check if the last Regex is working for you? It should not take in account in how many subfolders the file is stored.

[mayurr98]

all of these events are different or it is in one event only?