Splunk Search

Odd Data Extraction via Rex

harshparikhxlrd
Path Finder

Hello,

I am trying to extract data for this log. I have the data logged into the search. What's odd is when I attempt to extract it, it only covers up to the Date of the 19th. The code:

0 Karma

woodcock
Esteemed Legend

So somebody changed the filename in there somewhere; try this:

index="monitoring" AND sourcetype="PEGA:WinEventLog:Application" AND (SourceName="RoboticLogging" OR SourceName="Application") AND (Type= "Information") AND ("TaskID=\"Logs\"") AND ("Department="CCC Sales"")
| rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
| where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
| rex  "Message=\"(?<log>.+?)\"" 
| timechart count by log 
| rename AppsLog AS "Start My Day", CalltrackerLog AS "Sales Tracker", QMLog AS "Queue Manager"
| eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
| fields - ResetMycallLog, ResetMyCallLog
| eval Time = strftime(_time, "%d %b") 
| fields - _time 
| table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

mydog8it
Builder

Field names are case sensitive. Being able to perform a "count by x" type search and seeing two diferent filed names (in your case - ResetMyCallLog and ResetMycallLog) indicates there are two different configurations for the data. So the timing of the events that you are seeing in the search results could be tied to when the configuration change occurred. Once the log naming issue is addressed the data can be seen as you desire without SPL heroics to fix the data issue.

In the mean time, you can try this:

 index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"") ("Department="CCC Sales"")
 | rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
 | where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
 | rex  "Message=\"(?<log>.+?)\"" 
 | timechart count by log 
 | rename AppsLog as "Start My Day", CalltrackerLog as "Sales Tracker", QMLog as "Queue Manager"
 | eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
 | eval Time = strftime(_time, "%d %b") 
 | fields - _time 
 | table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

mydog8it
Builder

you might need to move the coalesce above the count statement, try this instead:

 index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"") ("Department="CCC Sales"")
 | rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
 | where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
 | rex  "Message=\"(?<log>.+?)\"" 
 | eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
 | timechart count by log 
 | rename AppsLog as "Start My Day", CalltrackerLog as "Sales Tracker", QMLog as "Queue Manager"
 | eval Time = strftime(_time, "%d %b") 
 | fields - _time 
 | table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share some sample events you're trying to parse.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mydog8it
Builder

If you replace line 5 with "|stats count by log" and eliminate the rest of the SPL, do you get a count for both logs?

0 Karma

harshparikhxlrd
Path Finder

It doesn't look like it. Besides, that just organizes it by the log itself and I want to see it in a timechart format to extract data by the day rather than totaling it all by each log.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...