help to build the query using abstract command

[logloganathan]

base query | regex field= "XXX*(?.*)" | stats count by regular_expression_value

this query displaying 5 lines but want only the first lines

how to get using abstract maxlines=1

[niketn · Accepted solution]

@logloganathan, based on your description so far seems like you want your regular expression to return result only from first line of an event. The .* Regular Expression by default stops at a line break which should do it. You are focused on abstract and rex command however, even if feasible that might not be right way at all. We would not be able assist you properly unless you provide further detail of what regular expression you have used and provide some mocked up anonymized data.

What do you mean by regular expression..it having 5 lines value? It can either be raw event with data across 5 lines or Regular Expression based extraction that fetches 5 lines instead of 1.

Whether it is _raw event with 5 lines or Regular Expression fetching 5 lines, you can adjust your Regular Expression to fetch only the first line (which would be ideal way).

Although I have taken an example for Splunk's _internal log which is always 1 line but you can try with your base search instead along with your own regex:

index=_internal sourcetype=splunkd
| abstract maxlines=1
| rex "^([^\s]+)\s([^\s]+)\s([^\s]+)\s(?<logLevel>[^\s]+)\s"
| table logLevel _raw

[logloganathan]

This is one i need. Thanks for your help!!
very helpful Nikenilay!! Thanks Again

[niketn]

@logloganathan, I am glad it worked. However, like I said, you should ideally be able to handle directly in rex command without having to use abstract command which is working for you but is actually just an overhead.

[p_gurav]

Can you try :

base query | regex field= "XXX*(?.{10}).*\n" OR  base query | regex field= "XXX*(?[^\n\r]+)"

[logloganathan]

is it possible to do the same with abstract command?

[richgalloway]

Try

base query | regex field= "XXX*(?.*)" | stats count by regular_expression_value | head 1

[logloganathan]

it wont work..it provide table with one result

[richgalloway]

Isn't that what you asked for? ("want only the first lines") If you want more than one line, change the "1" to the desired number.

If it's something else you seek, please clarify the question.

[logloganathan]

Actually i have regular expression and displaying the value
that value have 5 lines. i want to reduce that using the abstract command
how to do that

base query | regex field= "XXX*(?.*)" | stats count by regular_expression_value

regular_expression_value count
5 lines 4
3 lines 8

[richgalloway]

The abstract command is for text, not stats.

[logloganathan]

Could you please modify the same command without stats and substitute abstract

[richgalloway]

base query | regex field= "XXX*(?.*)" | abstract maxlines=1

[logloganathan]

what will it do?
it not providing the answer i expected

[richgalloway]

What answer are you expecting? What exactly are you trying to do? You insist on using abstract, but perhaps that is not the way to accomplish your goal.

[logloganathan]

Hi,

actually i have regular expression..it having 5 lines value.
i want one line using abstract.
is it possible to do?
Could you please help me in this request.

[richgalloway]

It's still not clear to me what your goal is. You've re-stated the original request and not added any clarification. I've done all I can do with what you've provided so far.

[logloganathan]

Thanks for your help
i think we can't combine abstract command and regex.