Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Splunk querying nested log
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a log below and I want to get the value of Description under :- Calling Checklist1003
How do I do that ??
Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for
11/21/2019 09:21:53.345 applicant .
11/21/2019 09:21:53.345
11/21/2019 09:21:53.358 -----------------------------------------
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here's how I would do it. This assumes that the description will never be more than two lines long. Here's a run anywhere example using the data you provided in the initial post:
| makeresults count=1
| eval data="Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for
11/21/2019 09:21:53.345 applicant .
11/21/2019 09:21:53.345
11/21/2019 09:21:53.358 -----------------------------------------"
| rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=data max_match=2 "Description: (?<Description>[^\n]+\n[^\n]+)"
| eval Description=mvindex(Description, -1)
The last three lines of that are applicable to you except you would remove the field=data and replace it with field=_raw. This removes the date/time stamps from the message and grab everything after each Description plus 1 line with the rex and then only returns the last Description in the event with the eval.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One log event
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
