How to capture type of events in fields based on single event type?

[raj_mpl]

Hi All ,
1)How do you capture INFO/ERROR/WARN events using regular expression ?
2)How do you capture the rest of the events not including INFO/ERROR/WARN events using regular expression ?
Sample log looks like this

[30/07/18 17:42:00:492 XXX] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816.
[30/07/17 17:42:00:492 EST] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxxx - The total memory is 111111111 and the memory available is 2638295816.
[30/07/17 17:42:00:492 XXX] 00000056 SystemOut     O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxxx - The total memory is 1111111 and the memory available is 2638295816.
[30/07/17 15:37:42:379 XXX] 00001db5 LdapConnectio I xxx.xxx.xx.xx.xxxxx.xxxx.xxxxxxxxxx  reCreateDirContext(String errorMessage) xxxxxxxxx The user registry is now connected to 'xxxxxxxxxxxxxx' LDAP Server.
[30/07/17 15:33:59:281 XXX] 0000xxxx0 SystemOut O Into the constructor of xxxxx

Thanks

[Richfez]

A regex like the one in the run-anywhere sample should do it.

| makeresults | eval _raw="[30/07/18 17:42:00:492 XXX] 00000056 SystemOut O 30 Jul 2017 17:42:00:492 [INFO] [xxxxxx] [] xxxxx - The total memory is 411116 and the memory available is 2638295816."
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"

The first line with makeresults and eval simple create a log line like yours is.
The second line is the rex, which creates a field "log_level" from your INFO, WARN or ERROR portion and "log_message" from all that's left to the end.

Happy Splunking,
Rich

[Richfez]

@raj_mpl - sorry, I edited your "answer" and put it as a comment under this answer, because that's where it belongs, but .. somehow it got deleted? Well, no matter - I apologize, but I remember the question so I'll just add some answer here.

To get some statistics, I'd use either timechart or stats. For instance,

<your base search> 
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| timechart count by log_level

or

<your base search> 
| rex "\[(?<log_level>(INFO|WARN|ERROR)[^\]]*)\](?<log_message>.*)"
| stats count by log_level

the by log_level could be by log_level, host, or almost any other thing. Play with those two options and some variants and see where that gets you.

For reference:
The Splunk docs on stats
The Splunk docs on timechart

[raj_mpl]

Hi @rich7177 thank you for your response , the query you have provided works fine ,can you give me a query to build same statistics for all the events in my log more than 2000+ each day