How to extract the profile from the log?

[yograjpatel]

INFO Decrypted user token received as header:

{"phoneNumber":"888888888","firstName":"Alan ","lastName":"Mmm","email":"alan@mmmcom","id":"658336","guid":"f07286ef-d3ea-4319-ac45-39596354ce95","userType":"PROFILE_OWNER","profileId":"480783","profileGuid":"14d9b3a5-9350-435b-8f45-fe4556f465b7","profileName":"KARATE EAT NOW","profileOwnerPhoneNumber":"8585181878","profileOwnerFirstName":"Alan ","profileOwnerLastName":"Mmm","profileOwnerEmail":"alan@mmm.com","profileOwnerId":"658336"}

[nickhills · Accepted solution]

If your trying to do this at search time your syntax is not quite correct.

try this:

...|rex field=_raw "profileId\":\"(?<profileId>\d+)\""|table profileId

[yograjpatel]

is there a way to sort the count by month in ascending order.. like Nov, Dec, Jan.

I'm trying this but the data is not in order

INFO Decrypted user token received as header" "profileId" | eval Month=strftime(_time,"%b") | rex field=_raw "profileId\":\"(?\d+)\""|dedup profileId | stats count(profileId) by Month | sort -_time

[yograjpatel]

How Can i Extract the user "pmcmurchy@com.net" from the log?

INFO User [pmcmurchy@com.net] successfully logged into Myaccount Portal on :Fri Jan 26 09:37:53 EST 2018

[mayurr98]

try this

INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId) by month date_month| sort month | fields- month

let me know if this helps!

[yograjpatel]

No it didnt help me

[yograjpatel]

If I search for last 6 months its showing the chart like this...
Jan, July, Aug, Sep, Oct, Nov, Dec

[mayurr98]

then try this

 INFO Decrypted user token received as header" "profileId" | eval month=strftime(_time,"%m") | rex field=_raw "profileId\":\"(?<profileId>\d+)\"" | dedup profileId | stats count(profileId)  by date_year date_month month | sort date_year month | fields- date_year month

[yograjpatel]

thanks Mayur... this worked

[yograjpatel]

have tried the below but the unique values are not extracting.

" INFO Decrypted user token received as header" "profileId" | rex ":\s+(?\d+)\s+\/"

rex "\"profileId\"\s:\s\"(?P\d+)\""

just getting the total count.