Unable to get fields with rex?

[frnSpLrnr11]

Hello,

I have this search results:

Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}

I'm trying to get the number of each each _errorCode for each user flow.

I started with 

index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | stats count as ErrorCount by user_flow

I was able to get the number of error occurrences under each user flow. I wanted to expand this query to be more granular and include the error code so I would have:

UserFlow	ErrorCode	Error Count
AAAA	X	5
AAAA	Y	7
BBBB	F	1
BBBB	G	2

This is the query I came up with but the statistics tab are no longer showing anything

index="example_index" source="example_source" sourcetype="example_st" Error for | rex field=_raw "user flow: (?<user_flow>\w+)" | rex field=_raw "_errorCode:\\\":(?<error_code>\d+)" |stats count as ErrorCount by user_flow, error_code

I see the events tab are still populated with search results  but it looks like my addition to the query is not quite correct.

[gcusello · Accepted solution]

Hi @frnSpLrnr11,

please try this, where the first row is only for the sample:

| makeresults | eval _raw="Error for user flow: AAAAA - user: BBBB - Msg: {\"_errorCode\":Z, \"_message\": \"Example Error Message\"}"
| rex field=_raw "user flow: (?<user_flow>\w+)"
| rex field=_raw "_errorCode\\\":(?<error_code>[^,]+)"
| stats values(error_code) AS error_code count BY user_flow

Ciao.

Giuseppe

[gcusello]

Hi @frnSpLrnr11,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉