Splunk Search

multiple values for single field in multiple lines of a single multi-lined event

sf-mike
Splunk Employee
Splunk Employee

Below is my sample log. I'm trying to extract all the 'Pend Reason' codes and still maintain the host field which I'm extracting from the appserver line at the top. I've tried numerous combos but can't make it work. Please help!

Please ignore the extra font formatting in the example.

The TriZetto Group, Inc cerbnav0
Batch Router Module
Version 5.01.00.9 Mar 11 2012 08:46:31
Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved.

Application Server: MLTTSAPV164
Process ID        : 5932
User              : svcFAPTst

*-- Standard Error --*
================================
Initialization Phase Started.

Actual Run Start Date and Time     [11/26/2012 10:12:46.959]

Initialization Phase Complete.
================================
================================
Execution Phase Started.


The TriZetto Group, Inc cmcbclmu
Claims Multi-Eng Electronic Adjud. Program
Version 5.01.00.5 Apr 30 2012 16:36:32
Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved.

Application Server: MLTTSAPV165
Process ID        : 5932
User              : svcFAPTst

*-- Standard Error --*
================================
Initialization Phase Started.

Actual Run Start Date and Time     [11/26/2012 10:12:46.959]

Initialization Phase Complete.
================================
================================
Execution Phase Started.

Facets - Error: 11/26/2012 10:12:49.284
Return Code: 8
Error Code: 51301
Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 56 Warning Text =  0056-HOLD ALL CLAIMS FOR THIS PROVIDER
Pend Reason =  XC01 WMWM
Solution:  

Facets - Error: 11/26/2012 10:12:49.284
Return Code: 8
Error Code: 51301
Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 550 Warning Text =  PRPR-0046: PEND CLAIM TO PV03 
Pend Reason =  XC01 WMWM
Solution:  

Facets - Error: 11/26/2012 10:12:53.487
Return Code: 8
Error Code: 51301
Error Message: 823796580000 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 570 Warning Text =  IPCD-0013:  RMN CODE  (line 1)
Pend Reason =  CE08 WMUD
Solution:  


================================
Termination Phase Started.

Actual Run End Date and Time       [11/26/2012 10:13:31.959]

Termination Phase Complete.
The Highest return code is: 0
================================


Execution Phase Complete.
================================
================================
Termination Phase Started.

Actual Run End Date and Time       [11/26/2012 10:13:32.287]

Termination Phase Complete.
The Highest return code is: 0
================================
0 Karma

lguinn2
Legend

Here is how I would parse this log:

props.conf

[yoursourcetypehere]
MAX_EVENTS=500
TRUNCATE=0
TIME_PREFIX=Actual Run Start Date and Time\s+\[
MAX_TIMESTAMP_LOOKAHEAD = 25
SHOULD_LINEMERGE=true
MUST_BREAK_BEFORE=The TriZetto Group\, Inc cerbnav0
BREAK_ONLY_BEFORE_DATE = false
EXTRACT-e1=(?m)Application Server: (?<ApplicationServer>\S+)
REPORT-r1 = mv-pendreason

transforms.conf

[mv-pendreason]
REGEX = (?m)Pend Reason =  (?<PendReason>\S+\s\S+)
MV_ADD = true

Hope that helps/works for you...

lguinn2
Legend

This should work for zero or more occurrences of "Pend Reason". If there are no occurrences, then there will be no PendReason field. For one occurrence, there will be a single-valued PendReason field. Finally, if there are multiple values, PendReason will be a multi-valued field. Multi-valued fields can be manipulated with a variety of Splunk commands: mvexpand mvcombine nomv and the eval functions: mvcount mvfilter mvindex etc.

0 Karma

sf-mike
Splunk Employee
Splunk Employee

Thanks! One thing I forgot to mention is that there may be more or less than 2 codes for a 'Pend Reason' line. How would I handle the variance?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...