Splunk Search

How to collect data and correlate into a table?

ritesh14
Explorer


|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ "message": { "number": "1856345" }, "transaction": { "sample1": "value1", "sample2": "value2" }}<|<|


I am looking for collecting data from both of above message and correlate between two.
I am looking for numbers 272 and 1,856 from HERE
and looking for sample1 and sample2 from THERE

both HERE and THERE will have 272 common and that is the only one.

build a table between those two with

sample1, sample2, 1,856

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

| makeresults | eval data="|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ \"message\": { \"number\": \"1856345\" }, \"transaction\": { \"sample1\": \"value1\", \"sample2\": \"value2\" }}<|<|" | eval data=split(data,"
") | mvexpand data | eval _raw=data | fields - data
```Lines above just set up test data.  Omit in production.```
```Extract needed fields```
| rex "(?:\|[^\|]+){4}\|(HERE|THERE)\|(?<TYPE>[^\|]+)\|(?<number>[\d,]*)(?:\|[^\|]+){4}\|(?<json>[^\<]*)"
```Join events of the same type```
| stats values(*) as * by TYPE
```Convert the json field to single-value```
| nomv json
```Extract sample1 and sample2 values from the json field.```
| rex field=json "sample1\\\": \\\"(?<sample1>[^\\\"]+)"
| rex field=json "sample2\\\": \\\"(?<sample2>[^\\\"]+)"
| table sample1 sample2 number
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

ritesh14
Explorer

appologies for the delay. not able to login for few days. but above answer give me guidance and it worked now.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

| makeresults | eval data="|>TYPE|2022-04-25 18:38:40|2d7e908bo82cb8|1725357403659|HERE|TYPE/272|1,856|1.2.0|ABC|351c481f2de|NONE<|
|>TYPE|2022-04-25 18:38:19|8e61ty7ebd2c25|1725357403659|THERE|TYPE/272||1.2.0|ABCD|4552aa7f9ebd704a91c8|{authType}|{ \"message\": { \"number\": \"1856345\" }, \"transaction\": { \"sample1\": \"value1\", \"sample2\": \"value2\" }}<|<|" | eval data=split(data,"
") | mvexpand data | eval _raw=data | fields - data
```Lines above just set up test data.  Omit in production.```
```Extract needed fields```
| rex "(?:\|[^\|]+){4}\|(HERE|THERE)\|(?<TYPE>[^\|]+)\|(?<number>[\d,]*)(?:\|[^\|]+){4}\|(?<json>[^\<]*)"
```Join events of the same type```
| stats values(*) as * by TYPE
```Convert the json field to single-value```
| nomv json
```Extract sample1 and sample2 values from the json field.```
| rex field=json "sample1\\\": \\\"(?<sample1>[^\\\"]+)"
| rex field=json "sample2\\\": \\\"(?<sample2>[^\\\"]+)"
| table sample1 sample2 number
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...