Splunk Search

how to use rex to extract two words ...from raw logs


2020-12-17T01:21:44.690341+00:00 txn1.test-fdb-us-south-004 2020-12-17T01:21:44Z { "Severity": "10", "Time": "1608168104.425364", "Type": "MachineMetrics", "ID": "0000000000000000", "Elapsed": "5.00001", "MbpsSent": "2.59981", "MbpsReceived": "2.3487", "OutSegs": "12262", "RetransSegs": "0", "CPUSeconds": "0.111557", "TotalMemory": "67510792192", "CommittedMemory": "4303114240", "AvailableMemory": "63207677952", "ZoneID": "txn1", "MachineID": "txn1", "Machine": "", "LogGroup": "default", "Roles": "RV", "TrackLatestType": "Original" }



I came  up with :

index=fdb sourcetype=* |eval (rex "^s(?<severity>[.]*)y$") as sev | stats  count(eval(sev “40”)) as ERROR count(eval(sev “20”)) as WARN count(eval(sev “10")) as INFO  by sourcetype    


it doest work...



I want to. create a table or time chart. to  list all he severity according to sourcetype.


Labels (1)
0 Karma


You're confusing rex and eval.

See this rex line and the stats line, which is what you want

| makeresults
| eval sourcetype="test"
| eval _raw="2020-12-17T01:21:44.690341+00:00 txn1.test-fdb-us-south-004 2020-12-17T01:21:44Z { \"Severity\": \"10\", \"Time\": \"1608168104.425364\", \"Type\": \"MachineMetrics\", \"ID\": \"0000000000000000\", \"Elapsed\": \"5.00001\", \"MbpsSent\": \"2.59981\", \"MbpsReceived\": \"2.3487\", \"OutSegs\": \"12262\", \"RetransSegs\": \"0\", \"CPUSeconds\": \"0.111557\", \"TotalMemory\": \"67510792192\", \"CommittedMemory\": \"4303114240\", \"AvailableMemory\": \"63207677952\", \"ZoneID\": \"txn1\", \"MachineID\": \"txn1\", \"Machine\": \"\", \"LogGroup\": \"default\", \"Roles\": \"RV\", \"TrackLatestType\": \"Original\" }"
| rex "Severity[^\d]*(?<sev>\d+)"
| stats count(eval(sev=40)) as ERROR count(eval(sev=20)) as WARN count(eval(sev=10)) as INFO  by sourcetype
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...