Splunk Search
Highlighted

How to write a search to match Event 3 with Event 1 and match Event 4 with Event 2?

Communicator

Hello All,

Need help in building a search. Below is my log file events format:

Event 1 -- RequestType1
Event 2 -- RequestType2
Event 3 -- Error Reply for RequestType1
Event 4 -- Success Reply for RequestType2

Now I have to formulate a search to match Event 3 with Event 1 & Event 4 with Event 2.

Note: If it is an error, no unique field will be there to match with Request Type1.

Kindly help me out on this.

Regards,

0 Karma
Highlighted

Re: How to write a search to match Event 3 with Event 1 and match Event 4 with Event 2?

Legend

May be easier to extract the value for requesttype in to a field using something like this and then group, sort is one example of grouping. Best approach would depend on what you intend to do with the results. The regex below assumes request type is always at the end.

..| rex "\b(?<rt>\w+)\b$" | sort rt
0 Karma