Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Splunk querying nested log

shwetamis
Explorer
‎11-21-2019 07:02 AM

I have a log below and I want to get the value of Description under :- Calling Checklist1003
How do I do that ??

Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine

11/21/2019 09:21:53.297

11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0

11/21/2019 09:21:53.297

11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for

11/21/2019 09:21:53.345 applicant .

11/21/2019 09:21:53.345

11/21/2019 09:21:53.358 -----------------------------------------

Tags (1)
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

dmarling
Builder
‎11-21-2019 09:41 AM

Here's how I would do it. This assumes that the description will never be more than two lines long. Here's a run anywhere example using the data you provided in the initial post:

| makeresults count=1
| eval data="Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for
11/21/2019 09:21:53.345 applicant .
11/21/2019 09:21:53.345
11/21/2019 09:21:53.358 -----------------------------------------"
| rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=data max_match=2 "Description: (?<Description>[^\n]+\n[^\n]+)"
| eval Description=mvindex(Description, -1)

The last three lines of that are applicable to you except you would remove the field=data and replace it with field=_raw. This removes the date/time stamps from the message and grab everything after each Description plus 1 line with the rex and then only returns the last Description in the event with the eval.

If this comment/answer was helpful, please up vote it. Thank you.

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

dmarling
Builder
‎11-21-2019 09:41 AM

Here's how I would do it. This assumes that the description will never be more than two lines long. Here's a run anywhere example using the data you provided in the initial post:

| makeresults count=1
| eval data="Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for
11/21/2019 09:21:53.345 applicant .
11/21/2019 09:21:53.345
11/21/2019 09:21:53.358 -----------------------------------------"
| rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=data max_match=2 "Description: (?<Description>[^\n]+\n[^\n]+)"
| eval Description=mvindex(Description, -1)

The last three lines of that are applicable to you except you would remove the field=data and replace it with field=_raw. This removes the date/time stamps from the message and grab everything after each Description plus 1 line with the rex and then only returns the last Description in the event with the eval.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 09:47 AM

Thank you, this is very good. But I have just pasted a part of the log just to show an example of how my data looks, the field Description is repeated about 7-8times in the log ( log is pretty big), so under eval data do I need to paste the whole log ?

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 10:00 AM

Actually try this instead:

| makeresults count=1
| eval data="Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 09:21:53.297 UW_10.30 KB engine
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 UWROUTER service will be used for underwriting
11/21/2019 09:21:53.297 ----------------------------------------------------------------
11/21/2019 09:21:53.297 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 09:21:53.297 Fault type: Application Severity: Info
11/21/2019 09:21:53.297 Description: This case will be underwritten using UWROUTER 1.0
11/21/2019 09:21:53.297
11/21/2019 09:21:53.297 Calling Checklist1003
11/21/2019 09:21:53.345 ----------------------------------------------------------------
11/21/2019 09:21:53.345 Message type: Code: 118310 dec, 1ce26 hex
11/21/2019 09:21:53.345 Fault type: Undefined Severity: Undefined
11/21/2019 09:21:53.345 Description: Hired From Date is missing for secondary employment for
11/21/2019 09:21:53.345 applicant .
11/21/2019 09:21:53.345
11/21/2019 09:21:53.358 -----------------------------------------"
| rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=data max_match=0 "Calling Checklist[^\n]+\n[^\n]+(?<checklist>[^\-]+)"
| rex field=checklist "Description: (?<Description>[^\e]+)"

I create a "checklist" field that grabs everything under calling checklist1003 between the "-" lines and then extracts the description from that. That is a cleaner way to do it I believe.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 10:41 AM

My Query: index=du sourcetype="du:sbaservice-log" du_service="sbawf1.3" | rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g" | rex field=data max_match=0 "Calling Checklist1003[^\n]+\n[^\n]+(?[^-]+)" | rex field=checklist "Description: (?[^\e]+)" | rex field=_raw "INST_INFO:\s\d+|(?.*)|" | rex field=_raw "lenderCaseNo\s[(?\d+)]" | eval BTime = strptime(Begin_time, "%H:%M:%S.%3N") | eval CTime = strptime(Completion_time, "%H:%M:%S.%3N") | eval ResTime=CTime-BTime

Result:
Description
No validation errors were found

Expected:
Description: Hired From Date is missing for secondary employment for

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 10:47 AM

You still had field=data which was just for my example. This will fix that:

index=du sourcetype="du:sbaservice-log" du_service="sbawf1.3" 
| rex field=_raw mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g" 
| rex field=_raw max_match=0 "Calling Checklist[^\-]+[^\n]+\n[^\n]+(?<checklist>[^\-]+)" 
| rex field=checklist "Description: (?<Description>[^\e]+)" 
| rex field=_raw "INST_INFO\:\s\d+\|(?.*)\|" 
| rex field=_raw "lenderCaseNo\s[(?\d+)]" 
| eval BTime = strptime(Begin_time, "%H:%M:%S.%3N") 
| eval CTime = strptime(Completion_time, "%H:%M:%S.%3N") 
| eval ResTime=CTime-BTime
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 11:03 AM

I corrected it, still not getting expected result

index=du sourcetype="du:sbaservice-log"
| rex field=_raw mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=_raw max_match=0 "Calling Checklist1003[^\n]+\n[^\n]+(?[^-]+)"
| rex field=checklist "Description: (?[^\e]+)"
| rex field=_raw "INST_INFO:\s\d+|(?.*)|"
| rex field=_raw "lenderCaseNo\s[(?\d+)]"
| eval BTime = strptime(Begin_time, "%H:%M:%S.%3N")
| eval CTime = strptime(Completion_time, "%H:%M:%S.%3N")
| eval ResTime=CTime-BTime
|table Description lenderInstName lenderCaseNumber Begin_time Completion_time

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 11:21 AM

Are you only wanting stuff after Checklist1003? Running the below run anywhere example returns results I expect:

| makeresults count=1 
| eval _raw="11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:49.929 Fault type: Application Severity: Info
 11/21/2019 12:52:49.929 Description: Verification Successful 
 11/21/2019 12:52:49.929 
 11/21/2019 12:52:49.929 ----------------------------------------------------------------
 11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:49.929 Fault type: Application Severity: Info
 11/21/2019 12:52:49.929 Description: No errors were detected 
 11/21/2019 12:52:49.929 
 11/21/2019 12:52:49.929 Performing a CaseInit
 11/21/2019 12:52:49.929 LOAN_APPLICATION found. Send to store as Original Mismo 1003!
 11/21/2019 12:52:50.604 Validating reply from CaseInit
 11/21/2019 12:52:50.604 ----------------------------------------------------------------
 11/21/2019 12:52:50.604 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.604 Fault type: Application Severity: Info
 11/21/2019 12:52:50.604 Description: CaseInit completed successfully 
 11/21/2019 12:52:50.604 
 11/21/2019 12:52:50.604 Inst ID set for EH-020 [12121231]
 11/21/2019 12:52:50.604 Casefile ID [xxxxxxx]
 11/21/2019 12:52:50.604 lenderCaseNo [yyyyyyy]
 11/21/2019 12:52:50.604 OperStatus_in_mp_casefile_set is not defined.
 11/21/2019 12:52:50.604 Calling Credential service to get traits 
 11/21/2019 12:52:50.624 ----------------------------------------------------------------
 11/21/2019 12:52:50.624 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.624 Fault type: Application Severity: Info
 11/21/2019 12:52:50.624 Description: InstTraitRequest completed successfully 
 11/21/2019 12:52:50.624 
 11/21/2019 12:52:50.625 Call RESTBridge for conventional loan with GUID [abbababsbasasas], 
 11/21/2019 12:52:50.625 INST_INFO: 12121231|somecompany
 11/21/2019 12:52:50.625 
 11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::callRESTBridge() ...
 11/21/2019 12:52:50.625 BASE_GUID for VDVS [abbababsbasasas]
 11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::sendRESTBridgeClientRequest...
 11/21/2019 12:52:50.625 Call RESTBridgeProxy.sendRESTBridgeRequest: 
 11/21/2019 12:52:50.625 Svcname= RESTBridge
 11/21/2019 12:52:50.625 Major= 1
 11/21/2019 12:52:50.625 Minor= 0
 11/21/2019 12:52:50.625 Command= RESTBridge
 11/21/2019 12:52:50.628 End RESTBridgeSubsystem::sendRESTBridgeClientRequest
 11/21/2019 12:52:50.628 End RESTBridgeSubsystem::callRESTBridge()
 11/21/2019 12:52:50.628 SBAWF13Service_Impl:Underwrite:BESTFIT_PRODUCT_SPECIFICATIONS file attachment is not found. This is NOT a multi-product case
 11/21/2019 12:52:50.629 Determine ProdAlt case: 
 11/21/2019 12:52:50.629 ProdAlt Flag [OFF]
 11/21/2019 12:52:50.629 LoanType [01]
 11/21/2019 12:52:50.629 prodAltTrait [0]
 11/21/2019 12:52:50.629 This is NOT a Product alternative case!
 11/21/2019 12:52:50.629 CONVERSION_TARGET: RES,HTML
 11/21/2019 12:52:50.629 User format Request: XML,HTML
 11/21/2019 12:52:50.629 Determining the underwriting service to be used
 11/21/2019 12:52:50.629 Set to use Default engine UWROUTER,1,0 for underwriting
 11/21/2019 12:52:50.629 Underwrite::determineUWService::multiProductCase =0
 11/21/2019 12:52:50.629 This is not a multi-product case.
 11/21/2019 12:52:50.629 ----------------------------------------------------------------
 11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.629 Fault type: Application Severity: Info
 11/21/2019 12:52:50.629 Description: This is a resubmission of a case that was underwritten using the
 11/21/2019 12:52:50.629 UW_10.30 KB engine 
 11/21/2019 12:52:50.629 
 11/21/2019 12:52:50.629 UWROUTER service will be used for underwriting
 11/21/2019 12:52:50.629 ----------------------------------------------------------------
 11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.629 Fault type: Application Severity: Info
 11/21/2019 12:52:50.629 Description: This case will be underwritten using UWROUTER 1.0 
 11/21/2019 12:52:50.629 
 11/21/2019 12:52:50.629 Calling Checklist1003
 11/21/2019 12:52:50.670 ----------------------------------------------------------------
 11/21/2019 12:52:50.670 Message type: Code: -1 dec, ffffffff hex
 11/21/2019 12:52:50.670 Fault type: Unknown Severity: Info
 11/21/2019 12:52:50.670 Description: Begin file type 104 checklist. 
 11/21/2019 12:52:50.670 
 11/21/2019 12:52:50.676 ----------------------------------------------------------------
 11/21/2019 12:52:50.676 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.676 Fault type: Application Severity: Info
 11/21/2019 12:52:50.676 Description: Checklist1003 completed successfully 
 11/21/2019 12:52:50.676 
 11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _creditReptMISMO = '1'
 11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _MISMOVersion = '2.1'
 11/21/2019 12:52:50.684 Loan Type: [01]
 11/21/2019 12:52:50.708 ----------------------------------------------------------------
 11/21/2019 12:52:50.708 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.708 Fault type: Application Severity: Info
 11/21/2019 12:52:50.708 Description: createCrReportRequest completed successfully 
 11/21/2019 12:52:50.708 
 11/21/2019 12:52:50.708 No Credit Report requests are needed
 11/21/2019 12:52:50.708 Calling ChecklistCred
 11/21/2019 12:52:50.719 SINGLEIN=0
 11/21/2019 12:52:50.732 ----------------------------------------------------------------
 11/21/2019 12:52:50.732 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:50.732 Fault type: Application Severity: Info
 11/21/2019 12:52:50.732 Description: ChecklistCred completed successfully 
 11/21/2019 12:52:50.732 
 11/21/2019 12:52:50.732 Autocopy not requested
 11/21/2019 12:52:50.732 command : UNDERWRITE
 11/21/2019 12:52:50.732 du underwrite : 1
 11/21/2019 12:52:50.732 set BASE_GUID for DUKB service: abbababsbasasas
 11/21/2019 12:52:50.732 Set processUndewrriteVars.conversionTarget = RES,HTML
 11/21/2019 12:52:50.732 Call IDGen for Doc_Type[1], ID_Type[4], ID_Qty[1]
 11/21/2019 12:52:50.749 IDGen returns condition [SUCCESS]
 11/21/2019 12:52:50.749 Successfully retrieved new FindingID: 2085534376
 11/21/2019 12:52:50.749 command : Underwrite
 11/21/2019 12:52:50.749 du underwrite : 1
 11/21/2019 12:52:50.749 Performing DU underwrite ... 
 11/21/2019 12:52:50.749 Calling UWROUTER 1.0 to underwrite the case
 11/21/2019 12:52:50.750 Command[KB_Underwrite] set for Underwrite!
 11/21/2019 12:52:52.901 Validating reply from UWROUTER_1_0
 11/21/2019 12:52:52.901 ----------------------------------------------------------------
 11/21/2019 12:52:52.901 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
 11/21/2019 12:52:52.901 Fault type: Application Severity: Info
 11/21/2019 12:52:52.901 Description: UWROUTER completed successfully 
 11/21/2019 12:52:52.901 
 " 
| rex field=_raw mode=sed "s/([\n\r\s]+)\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g" 
| rex field=_raw max_match=0 "Calling Checklist[^\-]+[^\n]+\n[^\n]+(?<checklist>[^\-]+)" 
| rex field=checklist "Description: (?<Description>[^\e]+)"
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 11:28 AM

I only want the description from Calling Checklist1003

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 11:44 AM

I see what happened. This should fix it:

index=du sourcetype="du:sbaservice-log"
| rex field=_raw mode=sed "s/([\n\r\s]+)\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g" 
| rex field=_raw max_match=0 "Calling Checklist1003[^\-]+[^\n]+\n[^\n]+(?<checklist>[^\-]+)" 
| rex field=checklist "Description: (?<Description>[^\e]+)"
| rex field=_raw "INST_INFO\:\s\d+\|(?.*)\|"
| rex field=_raw "lenderCaseNo\s[(?\d+)]"
| eval BTime = strptime(Begin_time, "%H:%M:%S.%3N")
| eval CTime = strptime(Completion_time, "%H:%M:%S.%3N")
| eval ResTime=CTime-BTime
|table Description lenderInstName lenderCaseNumber Begin_time Completion_time
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 12:08 PM

that worked thank you :), so what was the issue ?

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 12:11 PM

Please accept the answer if this works for you. 🙂

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 12:29 PM

Thank you so much

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 12:11 PM

The iteration you were using of the "checklist" extract was pulling data from the first line after "Calling Checklist1003" until "-", but in one of the examples there was another line between which broke that logic. I adjusted it to go to the first line AFTER the line of "-" to start the "checklist" field and that fixed it. Sorry about that.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 10:50 AM

getting error: rror in 'rex' command: Encountered the following error while compiling the regex 'Calling Checklist1003[^\n]+\n[^\n]+(?[^-]+)': Regex: unrecognized character after (? or (?-.

0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 11:10 AM

seems like its picking the first description from the log line

signal alert flag is 0
Validating Underwrite request

Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
Fault type: Application Severity: Info
Description: No validation errors were found

0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 09:57 AM

11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:49.929 Fault type: Application Severity: Info
11/21/2019 12:52:49.929 Description: Verification Successful

11/21/2019 12:52:49.929

11/21/2019 12:52:49.929 ----------------------------------------------------------------
11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:49.929 Fault type: Application Severity: Info
11/21/2019 12:52:49.929 Description: No errors were detected

11/21/2019 12:52:49.929

11/21/2019 12:52:49.929 Performing a CaseInit
11/21/2019 12:52:49.929 LOAN_APPLICATION found. Send to store as Original Mismo 1003!
11/21/2019 12:52:50.604 Validating reply from CaseInit
11/21/2019 12:52:50.604 ----------------------------------------------------------------
11/21/2019 12:52:50.604 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.604 Fault type: Application Severity: Info
11/21/2019 12:52:50.604 Description: CaseInit completed successfully

11/21/2019 12:52:50.604

11/21/2019 12:52:50.604 Inst ID set for EH-020 [12121231]
11/21/2019 12:52:50.604 Casefile ID [xxxxxxx]
11/21/2019 12:52:50.604 lenderCaseNo [yyyyyyy]
11/21/2019 12:52:50.604 OperStatus_in_mp_casefile_set is not defined.
11/21/2019 12:52:50.604 Calling Credential service to get traits
11/21/2019 12:52:50.624 ----------------------------------------------------------------
11/21/2019 12:52:50.624 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.624 Fault type: Application Severity: Info
11/21/2019 12:52:50.624 Description: InstTraitRequest completed successfully

11/21/2019 12:52:50.624

11/21/2019 12:52:50.625 Call RESTBridge for conventional loan with GUID [abbababsbasasas],
11/21/2019 12:52:50.625 INST_INFO: 12121231|somecompany
11/21/2019 12:52:50.625

11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::callRESTBridge() ...
11/21/2019 12:52:50.625 BASE_GUID for VDVS [abbababsbasasas]
11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::sendRESTBridgeClientRequest...
11/21/2019 12:52:50.625 Call RESTBridgeProxy.sendRESTBridgeRequest:
11/21/2019 12:52:50.625 Svcname= RESTBridge
11/21/2019 12:52:50.625 Major= 1
11/21/2019 12:52:50.625 Minor= 0
11/21/2019 12:52:50.625 Command= RESTBridge
11/21/2019 12:52:50.628 End RESTBridgeSubsystem::sendRESTBridgeClientRequest
11/21/2019 12:52:50.628 End RESTBridgeSubsystem::callRESTBridge()
11/21/2019 12:52:50.628 SBAWF13Service_Impl:Underwrite:BESTFIT_PRODUCT_SPECIFICATIONS file attachment is not found. This is NOT a multi-product case
11/21/2019 12:52:50.629 Determine ProdAlt case:
11/21/2019 12:52:50.629 ProdAlt Flag [OFF]
11/21/2019 12:52:50.629 LoanType [01]
11/21/2019 12:52:50.629 prodAltTrait [0]
11/21/2019 12:52:50.629 This is NOT a Product alternative case!
11/21/2019 12:52:50.629 CONVERSION_TARGET: RES,HTML
11/21/2019 12:52:50.629 User format Request: XML,HTML
11/21/2019 12:52:50.629 Determining the underwriting service to be used
11/21/2019 12:52:50.629 Set to use Default engine UWROUTER,1,0 for underwriting
11/21/2019 12:52:50.629 Underwrite::determineUWService::multiProductCase =0
11/21/2019 12:52:50.629 This is not a multi-product case.
11/21/2019 12:52:50.629 ----------------------------------------------------------------
11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.629 Fault type: Application Severity: Info
11/21/2019 12:52:50.629 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 12:52:50.629 UW_10.30 KB engine

11/21/2019 12:52:50.629

11/21/2019 12:52:50.629 UWROUTER service will be used for underwriting
11/21/2019 12:52:50.629 ----------------------------------------------------------------
11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.629 Fault type: Application Severity: Info
11/21/2019 12:52:50.629 Description: This case will be underwritten using UWROUTER 1.0

11/21/2019 12:52:50.629

11/21/2019 12:52:50.629 Calling Checklist1003
11/21/2019 12:52:50.670 ----------------------------------------------------------------
11/21/2019 12:52:50.670 Message type: Code: -1 dec, ffffffff hex
11/21/2019 12:52:50.670 Fault type: Unknown Severity: Info
11/21/2019 12:52:50.670 Description: Begin file type 104 checklist.

11/21/2019 12:52:50.670

11/21/2019 12:52:50.676 ----------------------------------------------------------------
11/21/2019 12:52:50.676 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.676 Fault type: Application Severity: Info
11/21/2019 12:52:50.676 Description: Checklist1003 completed successfully

11/21/2019 12:52:50.676

11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _creditReptMISMO = '1'
11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _MISMOVersion = '2.1'
11/21/2019 12:52:50.684 Loan Type: [01]
11/21/2019 12:52:50.708 ----------------------------------------------------------------
11/21/2019 12:52:50.708 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.708 Fault type: Application Severity: Info
11/21/2019 12:52:50.708 Description: createCrReportRequest completed successfully

11/21/2019 12:52:50.708

11/21/2019 12:52:50.708 No Credit Report requests are needed
11/21/2019 12:52:50.708 Calling ChecklistCred
11/21/2019 12:52:50.719 SINGLEIN=0
11/21/2019 12:52:50.732 ----------------------------------------------------------------
11/21/2019 12:52:50.732 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.732 Fault type: Application Severity: Info
11/21/2019 12:52:50.732 Description: ChecklistCred completed successfully

11/21/2019 12:52:50.732

11/21/2019 12:52:50.732 Autocopy not requested
11/21/2019 12:52:50.732 command : UNDERWRITE
11/21/2019 12:52:50.732 du underwrite : 1
11/21/2019 12:52:50.732 set BASE_GUID for DUKB service: abbababsbasasas
11/21/2019 12:52:50.732 Set processUndewrriteVars.conversionTarget = RES,HTML
11/21/2019 12:52:50.732 Call IDGen for Doc_Type[1], ID_Type[4], ID_Qty[1]
11/21/2019 12:52:50.749 IDGen returns condition [SUCCESS]
11/21/2019 12:52:50.749 Successfully retrieved new FindingID: 2085534376
11/21/2019 12:52:50.749 command : Underwrite
11/21/2019 12:52:50.749 du underwrite : 1
11/21/2019 12:52:50.749 Performing DU underwrite ...
11/21/2019 12:52:50.749 Calling UWROUTER 1.0 to underwrite the case
11/21/2019 12:52:50.750 Command[KB_Underwrite] set for Underwrite!
11/21/2019 12:52:52.901 Validating reply from UWROUTER_1_0
11/21/2019 12:52:52.901 ----------------------------------------------------------------
11/21/2019 12:52:52.901 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:52.901 Fault type: Application Severity: Info
11/21/2019 12:52:52.901 Description: UWROUTER completed successfully

11/21/2019 12:52:52.901

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 09:51 AM

If you could paste a whole log event as an example (with anything sensitive fuzzed out) and confirm if you want all of the descriptions or only the ones after some specific pattern. If it's always after calling checklist1003 I can write a rex for that, if it's something else I would need to know that.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

shwetamis
Explorer
‎11-21-2019 10:04 AM

I believe that should work let me try.

0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 10:07 AM

It didn't work on your most recent example but this will:

| makeresults count=1
| eval data="11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:49.929 Fault type: Application Severity: Info
11/21/2019 12:52:49.929 Description: Verification Successful 
11/21/2019 12:52:49.929 
11/21/2019 12:52:49.929 ----------------------------------------------------------------
11/21/2019 12:52:49.929 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:49.929 Fault type: Application Severity: Info
11/21/2019 12:52:49.929 Description: No errors were detected 
11/21/2019 12:52:49.929 
11/21/2019 12:52:49.929 Performing a CaseInit
11/21/2019 12:52:49.929 LOAN_APPLICATION found. Send to store as Original Mismo 1003!
11/21/2019 12:52:50.604 Validating reply from CaseInit
11/21/2019 12:52:50.604 ----------------------------------------------------------------
11/21/2019 12:52:50.604 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.604 Fault type: Application Severity: Info
11/21/2019 12:52:50.604 Description: CaseInit completed successfully 
11/21/2019 12:52:50.604 
11/21/2019 12:52:50.604 Inst ID set for EH-020 [12121231]
11/21/2019 12:52:50.604 Casefile ID [xxxxxxx]
11/21/2019 12:52:50.604 lenderCaseNo [yyyyyyy]
11/21/2019 12:52:50.604 OperStatus_in_mp_casefile_set is not defined.
11/21/2019 12:52:50.604 Calling Credential service to get traits 
11/21/2019 12:52:50.624 ----------------------------------------------------------------
11/21/2019 12:52:50.624 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.624 Fault type: Application Severity: Info
11/21/2019 12:52:50.624 Description: InstTraitRequest completed successfully 
11/21/2019 12:52:50.624 
11/21/2019 12:52:50.625 Call RESTBridge for conventional loan with GUID [abbababsbasasas], 
11/21/2019 12:52:50.625 INST_INFO: 12121231|somecompany
11/21/2019 12:52:50.625 
11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::callRESTBridge() ...
11/21/2019 12:52:50.625 BASE_GUID for VDVS [abbababsbasasas]
11/21/2019 12:52:50.625 Begin RESTBridgeSubsystem::sendRESTBridgeClientRequest...
11/21/2019 12:52:50.625 Call RESTBridgeProxy.sendRESTBridgeRequest: 
11/21/2019 12:52:50.625 Svcname= RESTBridge
11/21/2019 12:52:50.625 Major= 1
11/21/2019 12:52:50.625 Minor= 0
11/21/2019 12:52:50.625 Command= RESTBridge
11/21/2019 12:52:50.628 End RESTBridgeSubsystem::sendRESTBridgeClientRequest
11/21/2019 12:52:50.628 End RESTBridgeSubsystem::callRESTBridge()
11/21/2019 12:52:50.628 SBAWF13Service_Impl:Underwrite:BESTFIT_PRODUCT_SPECIFICATIONS file attachment is not found. This is NOT a multi-product case
11/21/2019 12:52:50.629 Determine ProdAlt case: 
11/21/2019 12:52:50.629 ProdAlt Flag [OFF]
11/21/2019 12:52:50.629 LoanType [01]
11/21/2019 12:52:50.629 prodAltTrait [0]
11/21/2019 12:52:50.629 This is NOT a Product alternative case!
11/21/2019 12:52:50.629 CONVERSION_TARGET: RES,HTML
11/21/2019 12:52:50.629 User format Request: XML,HTML
11/21/2019 12:52:50.629 Determining the underwriting service to be used
11/21/2019 12:52:50.629 Set to use Default engine UWROUTER,1,0 for underwriting
11/21/2019 12:52:50.629 Underwrite::determineUWService::multiProductCase =0
11/21/2019 12:52:50.629 This is not a multi-product case.
11/21/2019 12:52:50.629 ----------------------------------------------------------------
11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.629 Fault type: Application Severity: Info
11/21/2019 12:52:50.629 Description: This is a resubmission of a case that was underwritten using the
11/21/2019 12:52:50.629 UW_10.30 KB engine 
11/21/2019 12:52:50.629 
11/21/2019 12:52:50.629 UWROUTER service will be used for underwriting
11/21/2019 12:52:50.629 ----------------------------------------------------------------
11/21/2019 12:52:50.629 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.629 Fault type: Application Severity: Info
11/21/2019 12:52:50.629 Description: This case will be underwritten using UWROUTER 1.0 
11/21/2019 12:52:50.629 
11/21/2019 12:52:50.629 Calling Checklist1003
11/21/2019 12:52:50.670 ----------------------------------------------------------------
11/21/2019 12:52:50.670 Message type: Code: -1 dec, ffffffff hex
11/21/2019 12:52:50.670 Fault type: Unknown Severity: Info
11/21/2019 12:52:50.670 Description: Begin file type 104 checklist. 
11/21/2019 12:52:50.670 
11/21/2019 12:52:50.676 ----------------------------------------------------------------
11/21/2019 12:52:50.676 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.676 Fault type: Application Severity: Info
11/21/2019 12:52:50.676 Description: Checklist1003 completed successfully 
11/21/2019 12:52:50.676 
11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _creditReptMISMO = '1'
11/21/2019 12:52:50.676 SBAWF13Service_Impl.Underwrite: _MISMOVersion = '2.1'
11/21/2019 12:52:50.684 Loan Type: [01]
11/21/2019 12:52:50.708 ----------------------------------------------------------------
11/21/2019 12:52:50.708 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.708 Fault type: Application Severity: Info
11/21/2019 12:52:50.708 Description: createCrReportRequest completed successfully 
11/21/2019 12:52:50.708 
11/21/2019 12:52:50.708 No Credit Report requests are needed
11/21/2019 12:52:50.708 Calling ChecklistCred
11/21/2019 12:52:50.719 SINGLEIN=0
11/21/2019 12:52:50.732 ----------------------------------------------------------------
11/21/2019 12:52:50.732 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:50.732 Fault type: Application Severity: Info
11/21/2019 12:52:50.732 Description: ChecklistCred completed successfully 
11/21/2019 12:52:50.732 
11/21/2019 12:52:50.732 Autocopy not requested
11/21/2019 12:52:50.732 command : UNDERWRITE
11/21/2019 12:52:50.732 du underwrite : 1
11/21/2019 12:52:50.732 set BASE_GUID for DUKB service: abbababsbasasas
11/21/2019 12:52:50.732 Set processUndewrriteVars.conversionTarget = RES,HTML
11/21/2019 12:52:50.732 Call IDGen for Doc_Type[1], ID_Type[4], ID_Qty[1]
11/21/2019 12:52:50.749 IDGen returns condition [SUCCESS]
11/21/2019 12:52:50.749 Successfully retrieved new FindingID: 2085534376
11/21/2019 12:52:50.749 command : Underwrite
11/21/2019 12:52:50.749 du underwrite : 1
11/21/2019 12:52:50.749 Performing DU underwrite ... 
11/21/2019 12:52:50.749 Calling UWROUTER 1.0 to underwrite the case
11/21/2019 12:52:50.750 Command[KB_Underwrite] set for Underwrite!
11/21/2019 12:52:52.901 Validating reply from UWROUTER_1_0
11/21/2019 12:52:52.901 ----------------------------------------------------------------
11/21/2019 12:52:52.901 Message type: SBAWF13Info Code: 1001 dec, 3e9 hex
11/21/2019 12:52:52.901 Fault type: Application Severity: Info
11/21/2019 12:52:52.901 Description: UWROUTER completed successfully 
11/21/2019 12:52:52.901 
"
| rex field=data mode=sed "s/([\n\r])\d{2}\/\d{2}\/\d{4} \d{2}:\d{2}:\d{2}.\d{3}/\1/g"
| rex field=data max_match=0 "Calling Checklist[^\-]+[^\n]+\n[^\n]+(?<checklist>[^\-]+)"
| rex field=checklist "Description: (?<Description>[^\e]+)"
If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Solved! Jump to solution

dmarling
Builder
‎11-21-2019 09:23 AM

To confirm, is that one log event or multiple log events in your example?

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma
Reply
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...