Splunk Search

how to get custom table from logs

dhirendra224761
New Member

Hi, I am having trouble in my queries.
My logs are as below:
18/11/2018 12:00:41 IISYS export of Server 1 successfully transferred to Server 2
17/11/2018 03:32:09 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
16/11/2018 21:05:57 IISYS export of Server 1 successfully transferred to Server 3
16/11/2018 21:06:15 IISYS export of Server 1 successfully transferred to Server 4
17/11/2018 03:31:32 IISYS Import successfully ended on server 1 from export of server 2 with exit code 0
17/11/2018 03:36:55 IISYS Import successfully ended on server 1 from export of Server 3 with exit code 0

If imported then "OK" If not "KO" and for 3rd table, there is no export on sunday and no import processing on saturday.
Now I have to make tables based on above logs as below attached screenshot.

alt text

0 Karma

woodcock
Esteemed Legend

Your data does not match your chart. If you make them match, then maybe we can help you.

0 Karma

dhirendra224761
New Member

Hi @woodcock ... Sure I will corrct my logs as per the chart.

0 Karma

Richfez
SplunkTrust
SplunkTrust

What does a failed transfer or import look like? You didn't provide a log line for those...

The rest, or for anyone who wants to finish this answer after you provide that, might be along the lines of ...

base search ...
| rex "IISYS\s+(?<action>\w+) of (?<server>.*) (?<result>successfully|failed) transferred to (?<dest_server>.*)"
| rex "IISYS\s+(?<action>\w+) (?<result>successfully) ended on (?<server>.*) from export of (?<dest_server>.*) with exit code (?<exit_code>\d+)"
| eval in here to make result and exit_code all "OK" or "KO" as required
| timechart span=1d count by server, result_code.

Get us a sample of those log lines where it fails, so we know what to parse for the KO, and that should let us finish this for you.

0 Karma

dhirendra224761
New Member

Hi @rich7177,

Thanks for your input. especially for below rex command

| rex "IISYS\s+(?\w+) of (?.) (?successfully|failed) transferred to (?.)"

Let me try with this and let you know back again.
Thanks Again

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...