Splunk Search

regex/intelligent design question

asarolkar
Builder

I have a log entry that looks like this

2009-10-02 16:52:30 To USA-XXX F 2 &STR

where XXX is the account number - I have, as you may have guessed over 800 such account numbers (1 through 800 to be specific) trapped inside these logs that I need to do a timechart and group by on.

I want to be able to extract the account number XXX from this search somehow.

I have figured out the first step (unless regex is the way to go)

i) filter all the matches using sourcetype="usalog" | search *To*STR

ii) tag on another search that somehow filters the XXX

Any suggestions ? Perhaps field extractions ?

0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try something like :

sourcetype=usalog | rex field=_raw "To USA-(?<ac_number>\d{1,3})" | timechart count by ac_number

You can perform the Search time extraction on the account number inline using the rex command, as shown above , or save it(via Splunk Web or manual edit) in props.conf using the EXTRACT keyword in a sourcetype stanza :

[usalog] 
EXTRACT-extract_ac_num = To USA-(?<ac_number>\d{1,3})

View solution in original post

Damien_Dallimor
Ultra Champion

Try something like :

sourcetype=usalog | rex field=_raw "To USA-(?<ac_number>\d{1,3})" | timechart count by ac_number

You can perform the Search time extraction on the account number inline using the rex command, as shown above , or save it(via Splunk Web or manual edit) in props.conf using the EXTRACT keyword in a sourcetype stanza :

[usalog] 
EXTRACT-extract_ac_num = To USA-(?<ac_number>\d{1,3})

asarolkar
Builder

Thank you !

That worked like a charm !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...