I have a following splunk log
2018-03-13T06:28:23.543266+00:00 Commissions.development.loan*** 103a9[[APP/PROC/WEB/0]]: cf_foundation=px-*** cf_app_name=loan*** cf_app_id=**** cf_org_name=Commissions cf_org_id=***** cf_space_name=development cf_space_id=70344c05-60c9-437b-ab88-432a33101022 .source.s_cf_apps {"@timestamp":"2018-03-12T23:28:23.542-07:00","@version":1,"message":"class CreateLoanRequestPayload {\n createLoanRequest: class CreateLoanRequest {\n header: class Header {\n senderid: Test123\n channelid: channel123\n applicationid: NFS\n applicationuserid: user123\n sessionid: session123\n interactionid: intc123\n activityid: actv123\n workflowid: wf123\n timestamp: 2018-03-13T16:50:21.298Z\n storeid: store123\n dealercode: dealer123\n masterdealercode: MdealerCode123\n originatingSenderId: orgSID\n userid: user123\n }\n loans: class Loans {\n account: class LoansAccount {\n commonCustomerId: CC_ID\n accountType: Type123\n accountSubType: SubType123\n billingAddress: class BillingAddress {\n addressLine1: addr1\n addressLine2: addr2\n cityName: chennai\n stateCode: 61478\n zip: 600017\n zipExt: 600018\n optOut: opt_Out\n optOutReason: opt_Out_reason\n optOutType: opt_Out_type\n }\n accountNumber: acc123\n status: ReadyTest\n lastUpdateTime: 2018-03-13T16:50:21.298Z\n billCycleDay: 12\n paymentDueDay: 12\n primaryPlaceOfUseAddress: class PrimaryPlaceOfUseAddress {\n addressLine1: addr1\n addressLine2: addr2\n cityName: chennai\n stateCode: 61478\n zip: 600017\n zipExt: 600018\n optOut: opt_Out\n optOutReason: testStr123\n optOutType: opt_Out_type\n }\n eipIndicator: false\n daysInCurrentAccount: 12\n universalLineId: UNID123\n }\n accountNumber: acc123\n loanId: loan123\n oldLoanId: oLoan123\n currentLoanSystem: cLoan123\n commonCustomerId: CCID123\n balance: 1000.0\n phoneNumber: 9989898898\n fulfillmentType: FFType123\n transactionType: TType123\n returnAuthorizationType: RAType123\n promotions: [class Promotions {\n promotionId: PROMO123\n promotionAmount: 1000.0\n }]\n totalAmountFinanced: 3000.0\n totalNumberOfInstallments: 15\n nominalInterestRate: 1000.0\n annualPercentageRate: 100.0\n downPaymentAmount: 1000.0\n additionalDownPaymentAmount: 1000.0\n downPaymentDiscountAmount: 1000.0\n totalDownPaymentAmount: 1000.0\n recurringInstallmentAmount: 1000.0\n lastInstallmentAmount: 1000.0\n lastInstallmentDueDate: 2018-04-01\n remainingNumberOfInstallments: 12\n purchasedEquipment: class PurchasedEquipment {\n deviceId: DEV1234\n imei: imei123\n serialNumber: sNumber123\n deviceStatus: READYTEST\n sku: testStr123\n description: testStr123\n fullRetailPrice: 1000.0\n productType: TYPE01\n productSubType: SUBTYPE123\n salePrice: 1000.0\n }\n paymentSchedule: [class PaymentSchedule {\n paymentDueDate: 2018-04-01\n installmentNumber: 123\n paymentAmount: 1000.0\n }]\n returnedEquipment: class ReturnedEquipment {\n deviceId: dev123\n imei: imei123\n serialNumber: sNo123\n deviceStatus: ReadyTest\n sku: 3425127898\n deviceRecoveryType: RcType123\n tradeInAmount: 1000.0\n }\n effectiveStartDate: 2018-03-01\n effectiveEndDate: 2018-03-10\n financingModelType: MType123\n statusCode: 200\n remorseReturnNumberOfDays: 2\n originatingMasterDealerCode: O_MDCODE_123\n originatingSalesChannel: oSCHNL_123\n submissionStatus: READYTEST\n pendingFinancialTransactionStatus: READYTEST\n workFlowConditions: [BalanceTransferComplete, shipmentPending]\n agreementNumber: AGREE123\n clientWorkFlowType: TYPE123\n tradeInEligibility: false\n orderId: oID123\n documentSet: class DocumentSet {\n documents: [class Documents {\n documentId: doc123\n documentType: dType01\n }]\n }\n delayPayIndicator: false\n orderLocationState: stateFailed\n orderLocationCity: chennai\n shipToState: tamilnadu\n programType: Test\n sourceTransactionId: sTransID123\n sourceSubTransactionId: subsTransID123\n sourceTransactionTime: 2018-03-13T16:50:21.298Z\n freightCarrier: fCarrier123\n description: Testing_purpose\n serviceLevelCode: sLevel123\n shippingCharge: 200.0\n waiverIndicator: false\n taxExemptionIndicator: false\n eligibilities: [class Eligibilities {\n eligibilityType: elType1\n ineligibleReasons: [class IneligibleReasons {\n reasonCode: rc123\n }]\n }]\n payments: [class Payments {\n paymentAmount: 1000.0\n }]\n acceleratedAmount: amnt1000\n salesChannelId: sCID123\n userId: user1234\n previousLoanSystem: pLS123\n recurringChargeAmount: amnt1000.00\n transferQuoteId: quote123\n transferInitiatedDate: 2018-03-09\n transferAccountNumber: acc1234\n transferType: type01\n unbilledAmount: 1000.0\n crossDefaultIndicator: false\n syncPending: false\n activeDutyMilitaryFlag: false\n subStatusCode: testStr123\n activityType: testStr123\n activityDescription: testStr123\n activityTime: 2018-03-13T16:50:21.298Z\n currentBilledAmount: 1000.0\n shippingDiscountAmount: 1000.0\n shippingDiscountPercent: 1000.0\n shippingChargeCode: testStr123\n additionalPaymentAmount: 1000.0\n newBalance: 1000.0\n newRecurringInstallmentAmount: 1000.0\n newRemainingNumberOfInstallment: 12\n quoteDate: 2018-03-07\n customerCreditClass: testStr123\n writeOff: class WriteOff {\n code: testStr123\n description: testStr123\n effectiveTime: 2018-03-13T16:50:21.298Z\n }\n shippingDate: 2018-03-10T16:50:21.298Z\n trackingNumber: testStr123\n acceleratedDate: 2018-03-10\n paymentOverdueDays: 12\n pastDueIndicator: false\n }\n }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-11","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a36t4856-dc8a-4343-afb3-7o9166","eventType: ":"LoanWriteOffCompleted"}
Now I want to get the value of sourceTransactionTime from the log, I used below queries to get it,
index=cloudfoundry sourcetype=cloud*** "cf_foundation=px-npe01" cf_org_name="Commissions" cf_space_name=development cf_app_name="loan***"|rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\n]+)"|table sourceTransactionTime
it returns
2018-03-13T16:50:21.298Z\n freightCarrier: fCarrier123\n description: Testing_purpose\n serviceLevelCode: sLevel123\n shippingCharge: 200.0\n waiverIndicator: false\n taxExemptionIndicator: false\n eligibilities: [class Eligibilities {\n eligibilityType: elType1\n ineligibleReasons: [class IneligibleReasons {\n reasonCode: rc123\n }]\n }]\n payments: [class Payments {\n paymentAmount: 1000.0\n }]\n acceleratedAmount: amnt1000\n salesChannelId: sCID123\n userId: user1234\n previousLoanSystem: pLS123\n recurringChargeAmount: amnt1000.00\n transferQuoteId: quote123\n transferInitiatedDate: 2018-03-09\n transferAccountNumber: acc1234\n transferType: type01\n unbilledAmount: 1000.0\n crossDefaultIndicator: false\n syncPending: false\n activeDutyMilitaryFlag: false\n subStatusCode: testStr123\n activityType: testStr123\n activityDescription: testStr123\n activityTime: 2018-03-13T16:50:21.298Z\n currentBilledAmount: 1000.0\n shippingDiscountAmount: 1000.0\n shippingDiscountPercent: 1000.0\n shippingChargeCode: testStr123\n additionalPaymentAmount: 1000.0\n newBalance: 1000.0\n newRecurringInstallmentAmount: 1000.0\n newRemainingNumberOfInstallment: 12\n quoteDate: 2018-03-07\n customerCreditClass: testStr123\n writeOff: class WriteOff {\n code: testStr123\n description: testStr123\n effectiveTime: 2018-03-13T16:50:21.298Z\n }\n shippingDate: 2018-03-10T16:50:21.298Z\n trackingNumber: testStr123\n acceleratedDate: 2018-03-10\n paymentOverdueDays: 12\n pastDueIndicator: false\n }\n }\n}","logger_name":"com.tmobile.deep.scms.LoanProcessor","thread_name":"pool-1-thread-5","level":"INFO","level_value":20000,"APP_NAME":"loanProcessor_SCMS","eventID: ":"a1234e54-dc5a-4d23-afb3-oif16","eventType: ":"LoanVoidOrderCanceledCompleted"}
But I want only the date value "2018-03-13T16:50:21.298Z". Can anyone please suggest me what am doing wrong.
Hello!
Try this
rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\\n]+)"
Hi @karthi25,
try this regex:
... |rex field=_raw "sourceTransactionTime\:(?<sourceTransactionTime>[^\\\n]+)"
Hi
Try this regex modified
(?<sourceTransactionTime>[^\\\n]*)