Splunk Search

How to break events in this scenario

sarvan7777
New Member

Here is a subset of my log file. This content appears for an App named App-1, but it just repeats in my log for around 12 Apps.

Scan **App-1** 
<blah blah>
<blah blah>
Start of Test
Table row count : 100
Messages in queue: 100
JMS Topics and row count in queue:
10   Topic1
17   Topic2
13   Topic3
20   Topic5
40   Topic5 
End of Test... 

Scan for Threshold...

WARNING -- Threshold Exceeded!  

All I need is the table that has count and Topic1, Topic2 etc values as fields in Splunk

Count & Topic needs to be available as extracted fields in Splunk for the App-1 (App-1 is again an extracted field from this data set)

Any input is appreciated

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "Scan \*\*(?<App>\S+)\*\*"
| rex max_match=0 "(?<Count>\d+)\s+(?<Topic>Topic\d+)"
| eval _raw=mvzip(Topic, Count, "=")
| kv

View solution in original post

FrankVl
Ultra Champion

I would be enclined to say: create a scripted input for this, that translates these files to a csv containing the desired data and then ingest that into splunk.

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "Scan \*\*(?<App>\S+)\*\*"
| rex max_match=0 "(?<Count>\d+)\s+(?<Topic>Topic\d+)"
| eval _raw=mvzip(Topic, Count, "=")
| kv
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...