Splunk Search

How to extract AppId from whole text

New Member

Extracting AppID(s) from whole text and group by AppId and host

txid:944::appId:3::test:

txid:944::appId:3::tes2:

txid:944::appId:4::test4:

txid:944::appId:4::tes2:

txid:944::appId:5::test4:

txid:944::appId:6::tes2:

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Try something like this...

| rex "txid:(?<txid>[^:]+)::appId:(?<appId>[^:]+)::(?<host>[^:]+):"
| stats count by appId host txid
0 Karma

New Member

clientAppId="123123"

0 Karma

New Member

clientAppId="123123"

0 Karma

New Member

| rex "clientAppId(?[^=]+)"
| stats count by appId host

| rex "clientAppId=(?\d+)"
| stats count by appId host

i am not getting any result

0 Karma