splunk regex & xml

[ritesh14]

question is two fold

question 1 -
here is sample log

|>messageType|2020-02-2 14:01:55.995|094a786b-4d07-498c-9c26-685aa4119a8f|unique_id|dir|not_unique|time|trxn|<?XML data>|

messageType and dir is interesting field from splunk.

here is my query
index=sample_index source="source_1" dir=In messageType=Web | rex field=_raw "^(?:[^\|\n]*\|){8}(?P<transactions>[^\|]+)"

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

question 2 -
from above log last part xml data. here is sample xml

<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns3:trxn
xmlns:ns2="url1"
xmlns:ns3="url2">
<ResponseCode>OK</ResponseCode>
</ns3:trxn>
</soapenv:Body>
</soapenv:Envelope>

how can I get trxn and responnseCode here?

[scelikok]

Hi @ritesh14,

You can extract all in one regex;

^(?:[^\|\n]*\|){7}(?P<time>[^\|]+)\|(?P<transactions>[^\|]+)\|[^|]+<ResponseCode>(?P<responseCode>[^\<]+)[^|]+ns3:(?P<xml_trxn>[^\>]+)

If this reply helps you an upvote is appreciated.

[spammenot66]

@ritesh14In regards to the question below, can you give a n example of where you're expecting two values for trxn and time? this can be interpreted multiple ways.

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

[ritesh14]

in very simplest term..I have the query for single term either time or trxn and it worked fine.

I was looking for both value at the same time - trxn and time. basically I wanted to create a table with trxn and time. I did build the query but interesting not properly working

here is the two query I have build the responseTime coming on both are different

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| stats min(responseTime) AS "MinResponseTime" avg(responseTime) AS "AVG_ResponseTime" max(responseTime) AS "MaxResponseTime" by trxn
| eval AVG_ResponseTime=round(AVG_ResponseTime,0)
| sort -AVG_ResponseTime | table trxn MinResponseTime AVG_ResponseTime MaxResponseTime

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| timechart span=1m avg(responseTime) by trxn

if someone can help me what is wrong here

[ritesh14]

I got the problem statement

response times coming as comma separated value like 1,008 that is 1 sec and 8 ms.

how the splunk can parse comma separated digit as single INT?

Thanks