i want to list out the values with respective request is coming from. Please help

[prashanthberam]

am getting the messages coming for particular claim but in that from 2 fields am getting the different values. I want to separate them with the transactioncode. here I have some sample data.

|rex "Messagetext=(?.*)" | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLinecount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode CVPOutcomeCode CVPClaimStatusCode TransactionCode OutCome Messagetext UtilizationAmount| eval ReqTime=if(TransactionCode="REQ",_time,null())  | eval AckTime=if(TransactionCode="ACK",_time,null())| eval RespTime=if(TransactionCode="RSP",_time,null()) |stats values(CVPOutcomeCode) as CVPOutcomeCode values(CVPClaimStatusCode) as CVPClaimStatusCode values(ServiceLinecount) as ServiceLinecount values(ReqTime) as ReqTime values(AckTime) as AckTime values(RespTime) as RespTime values(DCN) as DCN values(GroupNumber) as GroupNumber values(SectionNumber) as SectionNumber values(CorporateEntityCode) as CorporateEntityCode values(ClaimType) as ClaimType values(VendorName) as VendorName values(VendorCode) as VendorCode values(OutCome) as OutCome values(Messagetext) as Messagetext values(UtilizationAmount) as UtilizationAmount by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationReq_Resp = RespTime-ReqTime |Eval _time=ReqTime|sort -_time|table _time DCN GroupNumber AckTime ReqTime RespTime CorrelationID SectionNumber CorporateEntityCode CVPClaimStatusCode CVPOutcomeCode ClaimType VendorName VendorCode ServiceLinecount OutCome DurationReq_Ack DurationReq_Resp Messagetext UtilizationAmount

For CVPClaimStatusCode CVPOutcomeCode, I want to display these values separately with respective TransactionCode .. how can I do that? Please help regarding this.

[woodcock]

Show us the current output of this search.
Then modify that by hand and show us what your desired output is.
I have NO IDEA what you are trying to do.

[naidusadanala]

your correlation ID has different transaction code.

So based on the transaction code you can filter out correlation Id assocatied with transaction

[gcusello]

Hi prashanthberam,
I'm not sure to have understood your need: you want to extract values after CorrelationID and TransactionCode?

If this is your need you can extract these fields using two regexes:

CorrelationID-(?<CorrelationID>[^,]*)
TransactionCode-(?<TransactionCode>[^,]*)

or also only one regex

CorrelationID-(?<CorrelationID>[^,]*),.*TransactionCode-(?<TransactionCode>[^,]*)

Bye.
Giuseppe

[prashanthberam]

index="ccsp_dev_was" host="dwauslwsapp045" SplunkLog VendorCode=CVP |rex "Messagetext=(?.*)" | fields _time CorrelationID DCN TransactionTimestamp GroupNumber ServiceLinecount SectionNumber CorporateEntityCode ClaimType VendorName VendorCode CVPOutcomeCode CVPClaimStatusCode TransactionCode OutCome Messagetext UtilizationAmount| eval ReqTime=if(TransactionCode="REQ",_time,null())  | eval AckTime=if(TransactionCode="ACK",_time,null())| eval RespTime=if(TransactionCode="RSP",_time,null()) |stats values(CVPOutcomeCode) as CVPOutcomeCode values(CVPClaimStatusCode) as CVPClaimStatusCode values(ServiceLinecount) as ServiceLinecount values(ReqTime) as ReqTime values(AckTime) as AckTime values(RespTime) as RespTime values(DCN) as DCN values(GroupNumber) as GroupNumber values(SectionNumber) as SectionNumber values(CorporateEntityCode) as CorporateEntityCode values(ClaimType) as ClaimType values(VendorName) as VendorName values(VendorCode) as VendorCode values(OutCome) as OutCome values(Messagetext) as Messagetext values(UtilizationAmount) as UtilizationAmount by CorrelationID | eval DurationReq_Ack=AckTime-ReqTime | eval DurationReq_Resp = RespTime-ReqTime |Eval _time=ReqTime|sort -_time|table _time DCN GroupNumber AckTime ReqTime RespTime CorrelationID SectionNumber CorporateEntityCode CVPClaimStatusCode CVPOutcomeCode ClaimType VendorName VendorCode ServiceLinecount OutCome DurationReq_Ack DurationReq_Resp Messagetext UtilizationAmount   

my search is like this but I want breakdown the fields CVPClaimStatusCode CVPOutcomeCode by using the Transactioncode because these values varies from req,ack, rsp, I want to display these values separately.