Splunk Search
Highlighted

Raw data only parsing the first instance

Path Finder

Hello All,

I have a data like this

X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

Now when I am using the query <search criteria> | table status, reason it is giving values "X" and "Y"
1. Trying to understand why it is not considering the values Z & Y and xyz & abc
2. If I have to get the result of values Z & Y and xyz & abc how to retrieve?

0 Karma
Highlighted

Re: Raw data only parsing the first instance

SplunkTrust
SplunkTrust

What is <search criteria>?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Raw data only parsing the first instance

Path Finder

Hi @richgalloway the raw data is like service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]

and my <search criteria> is service

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Ultra Champion

sample query:

| makeresults
| eval _raw="service: mnp, o=123, X1=[A(status=X, reason=Y), A(status=Z, reason=Y), A(status=xyz, reason=abc)]"
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| table status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*

recommend:

<search criteria> 
| rex max_match=0 "status=(?<status>\w+), reason=(?<reason>\w+)"
| fields status reason
| eval _counter = mvrange(0,mvcount(status))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>', _counter)]
| fields - _*
| table status, reason
0 Karma
Highlighted

Re: Raw data only parsing the first instance

Path Finder

Hello @to4kawa
It is still giving me values "X" and "Y"

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Ultra Champion

use where OR search

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Path Finder

I am only using where but still the same

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Ultra Champion

I see, your query is wrong

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Path Finder

Hi @to4kawa
can you please explain a bit more when you say the query is wrong? What I meant above is in the complete query I am not using search instead using where

service
| where not reason like "%P%"
|table status, reason

0 Karma
Highlighted

Re: Raw data only parsing the first instance

Ultra Champion
| where not reason like "%P%" 

This can't work.
where "%P%" come from?
Don't you select NOT (status="X" AND reason="Y")?

0 Karma