Unable to get the correct min and max values.

[maverick2701]

I'm a newbie as far as Splunk is concerned with modest regex skills.

We have events with the following patterns
fallbackAPIStatus={api1=133:..., api2=472:...,api3=498:...}
fallbackAPIStatus={api1=3535:...}
fallbackAPIStatus={api2=252:...,api3=655:...}

The numeric value indicates the response times and the ellipsis inidcates fields that I'm not interested in.

The number of apis within the braces is dynamic (between 1 and 4)

I want to be able to create a table as follows:
apiName TotalRequests Max-Response-Time Min-Response-Time
api1 2 3535 133
api2 2 472 252
api2 2 655 498

Here's my search:
index=my_logs sourcetype=my_sourcetype | rex field=_raw "fallbackAPIStatus={(?P[^}]+)}" | eval temp=split(fallBackApis,",") | rex field=temp "(?P[a-zA-Z-]+)=(?P[0-9]+):"|stats count as TotalRequests max(responseTime) as Max-Response-Time min(responseTime) as Min-Response-Time by apiName

I'm able to get the TotalRequests right but I'm not able to get the correct max and min response times

Can someone advise what I'm doing wrong here?

[grittonc]

I didn't have a problem with the Min-Response-Time or Max-Response-Time as fieldnames, but I did have to tweak the regex for apiName. It didn't have 0-9 as part of the set of characters to match for apiName. I also added the ellipses at the end of the regex. This run-anywhere example seems to do what you want.

I think your fieldnames for the rex commands (in <>) were eaten by the text editor so I had to make some guesses about what your code originally looked like. If you need to respond, can you try to use the "code sample" button above the editing window? It looks like '101010'. it will keep the fieldnames.

| makeresults 
| eval raw="fallbackAPIStatus={api1=133:...,api2=472:...,api3=498:...}|||fallbackAPIStatus={api1=3535:...}|||fallbackAPIStatus={api2=252:...,api3=655:...}" 
| makemv delim="|||" raw
| mvexpand raw
| rex field=raw "fallbackAPIStatus={(?P<fallBackApis>[^}]+)}" 
| eval temp=split(fallBackApis,",") 
| mvexpand temp
| rex field=temp "(?P<apiName>[a-zA-Z0-9-]+)=(?P<responseTime>[0-9]+):..."
|stats count as TotalRequests max(responseTime) as Max-Response-Time min(responseTime) as Min-Response-Time by apiName

[richgalloway]

"Max-Response-Time" and "Min-Response-Time" are not valid field names because of the -. Try using MaxReponseTime and MinResponseTime.