I have this following string
2019-05-17 11:30:14.262 INFO 13 --- [pool-3-thread-1] com.abcd.efgh.ijk.statuspage.StatusPage : Application[id=00, name='XYZ Service', environment='Production', status='DOWN'
i just need to extract value against the name keyword and use it as a field to run stats against it .
How can i extract the value ? Can someone plz help with the SPL ?
@officialsubho you can use this rex command
rex field=_raw "name=\'(?<name>[^\']+)\'"
I would have thought, Splunk automatically extracts it?
Anyway, Please find the regex
|makeresults
| eval myraw="2019-05-17 11:30:14.262 INFO 13 --- [pool-3-thread-1] com.abcd.efgh.ijk.statuspage.StatusPage : Application[id=00, name='XYZ Service', environment='Production', status='DOWN'"
| rex field=myraw "name=\'(?<name>[^\']+)\'"
| fields name
In regex101 => https://regex101.com/r/yWXFJ7/1
Thanks @koshyk , but i am not looking for the regex .
i Just need store the name='XYZ Service' in a separate field , so that i can run counts against it .
i am trying to figure out how many times a particular XYZ service showed down status on the logs .
let me know if that makes sense .
so you want the whole of name='XYZ Service'
to be in a separate field?
In the above regex, you will get the field name as "name", but you can change it to whatever it suits you.
|makeresults
| eval myraw="2019-05-17 11:30:14.262 INFO 13 --- [pool-3-thread-1] com.abcd.efgh.ijk.statuspage.StatusPage : Application[id=00, name='XYZ Service', environment='Production', status='DOWN'"
| rex field=myraw "name=\'(?<myNewField>[^\']+)\'"
| stats count by myNewField
..