This is the log i am getting in splunk
msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12
Cleanable Process Instance Count {"exception_management_workflow":{"finishedCount":6621,"cleanableCount":1113}}
i want output like
Engine finishedProcessInstanceCount
Engine12 6621
Could you please help me on that, i am trying below query but not working
index=abc cf_app_name="DEV" |rex field=_raw "engine.(?<pam>.........) ,finishedProcessInstanceCount...(?<sam>..\d+)" | table pam, sam
The example regex would work great if the engine name was followed immediately by a comma and the finished count, but that's not the case. While we could define a regex to extract both fields from the event, this is a good example of a time when multiple rex commands is easier to work with.
index=abc cf_app_name="DEV"
| rex "engine:(?<pam>\w+)"
| rex "finishedCount\\\":(?<sam>\d+)"
| table pam, sam
Query is not returning any data
It works with the sample event provided in the OP.
| makeresults
| eval _raw="msg: 2022-01-22 03:00:00.143 INFO 15 --- [ scheduling-1PurgeProcessCountTask : engine:Engine12
Cleanable Process Instance Count {\"exception_management_workflow\":{\"finishedCount\":6621,\"cleanableCount\":1113}}"
| rex "engine:(?<pam>\w+)"
| rex "finishedCount\\\":(?<sam>\d+)"
| table pam, sam
If it's not working with real data then it's possible either or both of the regular expressions need to be modified to match the real data.
It's not working