Splunk Search

Odd Data Extraction via Rex

harshparikhxlrd
Path Finder

Hello,

I am trying to extract data for this log. I have the data logged into the search. What's odd is when I attempt to extract it, it only covers up to the Date of the 19th. The code:

0 Karma

woodcock
Esteemed Legend

So somebody changed the filename in there somewhere; try this:

index="monitoring" AND sourcetype="PEGA:WinEventLog:Application" AND (SourceName="RoboticLogging" OR SourceName="Application") AND (Type= "Information") AND ("TaskID=\"Logs\"") AND ("Department="CCC Sales"")
| rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
| where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
| rex  "Message=\"(?<log>.+?)\"" 
| timechart count by log 
| rename AppsLog AS "Start My Day", CalltrackerLog AS "Sales Tracker", QMLog AS "Queue Manager"
| eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
| fields - ResetMycallLog, ResetMyCallLog
| eval Time = strftime(_time, "%d %b") 
| fields - _time 
| table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

mydog8it
Builder

Field names are case sensitive. Being able to perform a "count by x" type search and seeing two diferent filed names (in your case - ResetMyCallLog and ResetMycallLog) indicates there are two different configurations for the data. So the timing of the events that you are seeing in the search results could be tied to when the configuration change occurred. Once the log naming issue is addressed the data can be seen as you desire without SPL heroics to fix the data issue.

In the mean time, you can try this:

 index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"") ("Department="CCC Sales"")
 | rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
 | where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
 | rex  "Message=\"(?<log>.+?)\"" 
 | timechart count by log 
 | rename AppsLog as "Start My Day", CalltrackerLog as "Sales Tracker", QMLog as "Queue Manager"
 | eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
 | eval Time = strftime(_time, "%d %b") 
 | fields - _time 
 | table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

mydog8it
Builder

you might need to move the coalesce above the count statement, try this instead:

 index=monitoring sourcetype=PEGA:WinEventLog:Application (SourceName="RoboticLogging" OR SourceName="Application") (Type= "Information") ("TaskID=\"Logs\"") ("Department="CCC Sales"")
 | rex field=_raw "Automation=\"(?<Auto>.+?)\"" 
 | where Auto = "DA_E_SMDLogTime" OR Auto = "DA_E_AuditLog" OR Auto = "DA_E_AfterCallAuditLog"  
 | rex  "Message=\"(?<log>.+?)\"" 
 | eval "Reset My Call" = coalesce(ResetMycallLog, ResetMyCallLog)
 | timechart count by log 
 | rename AppsLog as "Start My Day", CalltrackerLog as "Sales Tracker", QMLog as "Queue Manager"
 | eval Time = strftime(_time, "%d %b") 
 | fields - _time 
 | table Time "Start My Day", "Sales Tracker", "Queue Manager", "Reset My Call"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share some sample events you're trying to parse.

---
If this reply helps you, Karma would be appreciated.
0 Karma

mydog8it
Builder

If you replace line 5 with "|stats count by log" and eliminate the rest of the SPL, do you get a count for both logs?

0 Karma

harshparikhxlrd
Path Finder

It doesn't look like it. Besides, that just organizes it by the log itself and I want to see it in a timechart format to extract data by the day rather than totaling it all by each log.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...