Splunk Search

How to use rex command to extract two fields and chart the count for both in one search query?

anuarora
Engager

I have a log statement like 2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{"message":{"TransactionStatus":true,"TransactioName":"removeLockedUser-1498029828160"}} .
How can i extract TransactionName and TranscationStatus and print in table form TransactionName and its count

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{\"message\":{\"TransactionStatus\":true,\"TransactioName\":\"removeLockedUser-1498029828160\"}}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "{\"TransactionStatus\":(?<TransactionStatus>[^,]*),\"TransactioName\":\"(?<TransactioName>[^\"]*)\""
| chart count OVER TransactioName BY TransactionStatus

SPECIAL NOTE: Are you sure there is not a missing n in your given text for TransactioName (this may have to be adjusted)?

View solution in original post

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval _raw="2017-06-21 12:53:48,426 INFO transaction.TransactionManager.Info:181 -{\"message\":{\"TransactionStatus\":true,\"TransactioName\":\"removeLockedUser-1498029828160\"}}"

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "{\"TransactionStatus\":(?<TransactionStatus>[^,]*),\"TransactioName\":\"(?<TransactioName>[^\"]*)\""
| chart count OVER TransactioName BY TransactionStatus

SPECIAL NOTE: Are you sure there is not a missing n in your given text for TransactioName (this may have to be adjusted)?

anuarora
Engager

Thanks Mr. Woodcock. This saved me a lot of time.

0 Karma

horsefez
Motivator

@woodcock
btw: Your syntax for "COMMENT" is not wrong, but there is a new one (since 6.5) you might find interesting.
http://docs.splunk.com/Documentation/Splunk/6.6.1/Search/Addcommentstosearches

0 Karma

woodcock
Esteemed Legend

I like mine better. When the create a genuine comment command, not a macro, then I will switch.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi anuarora
you could use this regex to extract your two fields:

\{\"TransactionStatus\"\:(?<TransactionStatus>[^,]*),\"TransactioName\"\:\"(?<TransactioName>[^\"]*)\"

you can put it in Field extraction or in rex command

| rex "\{\"TransactionStatus\"\:(?<TransactionStatus>[^,]*),\"TransactioName\"\:\"(?<TransactioName>[^\"]*)\""

Test it at https://regex101.com/r/8Ff4ji/1

Bye.
Giuseppe

0 Karma

anuarora
Engager

I tried below query but didn't get any success. It is always giving me 0.

sourcetype=10.240.204.69 "TransactionStatus" | rex field=_raw ".TransactionStatus (?.)" |stats count((status=true)) as success_count

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...