Splunk SPL- How do I use regex to create an alert?

[uagraw01]

Hello Splunker!

I created below regex from the raw events. And I want to create an alert which show the event in one cloumn only.

| rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)"
| rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)"
| rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)"
| rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)"
| rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)"

By using all the fields i want one liner column result like . Please let me know how to concate and use makemv command. And if any other approach then please guide me.

ServiceName

Error_Message

OrderNumber

Reason

ResponseTime

[gcusello]

Hi @uagraw01,

you should explore the transpose command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose) that permits to transpose a list of fields from row to column, something like this:

<your_search>
| rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)"
| rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)"
| rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)"
| rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)"
| rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)"
| table ServiceName Error_Message OrderNumber ResponseTime Reason
| transpose 5 
| rename "row 1" AS Value 
| fields Value

Ciao.

Giuseppe

[uagraw01]

@gcusello  I need a result output as below:

ServiceName: Paypal
Error_Message: Declined payment
OrderNumber: GGTHLL
ResponseTime: 500
Reason: User not registered

[gcusello]

Hi @uagraw01,

I replicated the output you indicated,

to have both the field name in a column and the value in another column you have to use the same search without the last row:

<your_search>
| rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)"
| rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)"
| rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)"
| rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)"
| rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)"
| table ServiceName Error_Message OrderNumber ResponseTime Reason
| transpose 5 
| rename "row 1" AS Value 

 If instead you want "<fieldname>: >fieldvalue>", you have to use a similar search:

<your_search>
| rex field=_raw "Site\|\_\_SYSTEM\__(?<ServiceName>[A-Za-z]+)"
| rex field=_raw "Message\s\=\s(?<Error_Message>.+\:\s[A-Za-z0-9]+)"
| rex field=_raw "failed:\s(?<OrderNumber>[A-Za-z0-9]+)"
| rex field=_raw "httpStatusCode\s\=\s(?<ResponseTime>[0-9]+)"
| rex field=_raw "ResponseTime\s\=\s(?<Reason>.+)"
| eval 
   ServiceName="ServiceName: ".ServiceName,
   Error_Message="Error_Message: ".Error_Message,
   OrderNumber="OrderNumber: ".OrderNumber,
   ResponseTime="ResponseTime: ".ResponseTime,
   Reason="Reason: ".Reason
| table ServiceName Error_Message OrderNumber ResponseTime Reason
| transpose 5 
| rename "row 1" AS Value 
| table Value

Ciao.

Giuseppe

[uagraw01]

@gcusello I tried some workarounds. And I succeed what I want to achieve, that is highlighted in the yellow.

[gcusello]

Hi @uagraw01,

good for you, but this is a different output than the one you shared.

why my solution doesn't work for you, what's the problem?

tell me if you need more help, otherwise, please accept one answer for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated 😉