Splunk Search

Why am I getting this concact msg from multiple event for after apply a regex?

Hugues
Path Finder

Hello All , thanks for the help, my exemple:

 

 

logStreamName _time message
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout
9/20/2211:22:23.295 AM
allo
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:22:23.295 AM allo1
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:23:23.295 AM Erreur
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:23:24.195 AM allo2
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout
9/20/2211:23:24.195 AM
allo4

 

I want get this output,  for apply after regex for extract some line around the erreur msg

logStreamName: _time ms
09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:22:23.295 AM

allo 

allo1

Error

allo2

allo4

 

if i try that search

index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | stats count by logStreamName | map maxsearches=20 search=" search index="bnc_6261_pr_log_conf" logStreamName=$logStreamName$ | eval ms=_time + message| stats values(ms) by logStreamName,_time "| transaction logStreamName | rex field=ms "(?<ERROR_MESSAGE>.{0,50}Error.{0,50})" 

it is not working if I perform the rex on msg, if I try use rex on logStreamName with different search string it is work, i try use transaction command for concact msg.

and I create ms variable  for add time to my msg , it force too keep the order of message, it the only whey a found.

Please help me.

Labels (2)
0 Karma
1 Solution

Hugues
Path Finder

Hello , I find a solytion base on what you give me.

 

index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | eval ms=_time + message| stats list(ms) as msg by logStreamName | rex field=msg "(?<Err_Mss>.((.*\n){0,3}).*disk\ space*((.*\n){0,3}))"

 

Thanks fo your help

Hugues

 

View solution in original post

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does this work for you?

| stats list(message) as ms by logStreamName _time
0 Karma

Hugues
Path Finder

Hello , I find a solytion base on what you give me.

 

index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | eval ms=_time + message| stats list(ms) as msg by logStreamName | rex field=msg "(?<Err_Mss>.((.*\n){0,3}).*disk\ space*((.*\n){0,3}))"

 

Thanks fo your help

Hugues

 

Tags (1)
0 Karma

Hugues
Path Finder

Thanks for your try, is not working , see the output

Hugues_0-1664381902305.png

my search base on what you give me

index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | stats count by logStreamName | map maxsearches=20 search=" search index="bnc_6261_pr_log_conf" logStreamName=$logStreamName$ | stats list(message) as ms by logStreamName _time"

and i try too

index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | stats list(message) as ms by logStreamName _time

 

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...