Splunk Search

How to collect data and correlate into a table?

ritesh14
Explorer


|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ "message": { "number": "1856345" }, "transaction": { "sample1": "value1", "sample2": "value2" }}<|<|


I am looking for collecting data from both of above message and correlate between two.
I am looking for numbers 272 and 1,856 from HERE
and looking for sample1 and sample2 from THERE

both HERE and THERE will have 272 common and that is the only one.

build a table between those two with

sample1, sample2, 1,856

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

| makeresults | eval data="|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ \"message\": { \"number\": \"1856345\" }, \"transaction\": { \"sample1\": \"value1\", \"sample2\": \"value2\" }}<|<|" | eval data=split(data,"
") | mvexpand data | eval _raw=data | fields - data
```Lines above just set up test data.  Omit in production.```
```Extract needed fields```
| rex "(?:\|[^\|]+){4}\|(HERE|THERE)\|(?<TYPE>[^\|]+)\|(?<number>[\d,]*)(?:\|[^\|]+){4}\|(?<json>[^\<]*)"
```Join events of the same type```
| stats values(*) as * by TYPE
```Convert the json field to single-value```
| nomv json
```Extract sample1 and sample2 values from the json field.```
| rex field=json "sample1\\\": \\\"(?<sample1>[^\\\"]+)"
| rex field=json "sample2\\\": \\\"(?<sample2>[^\\\"]+)"
| table sample1 sample2 number
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ritesh14
Explorer

appologies for the delay. not able to login for few days. but above answer give me guidance and it worked now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

| makeresults | eval data="|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ \"message\": { \"number\": \"1856345\" }, \"transaction\": { \"sample1\": \"value1\", \"sample2\": \"value2\" }}<|<|" | eval data=split(data,"
") | mvexpand data | eval _raw=data | fields - data
```Lines above just set up test data.  Omit in production.```
```Extract needed fields```
| rex "(?:\|[^\|]+){4}\|(HERE|THERE)\|(?<TYPE>[^\|]+)\|(?<number>[\d,]*)(?:\|[^\|]+){4}\|(?<json>[^\<]*)"
```Join events of the same type```
| stats values(*) as * by TYPE
```Convert the json field to single-value```
| nomv json
```Extract sample1 and sample2 values from the json field.```
| rex field=json "sample1\\\": \\\"(?<sample1>[^\\\"]+)"
| rex field=json "sample2\\\": \\\"(?<sample2>[^\\\"]+)"
| table sample1 sample2 number
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...