Splunk Search

splunk regex & xml

ritesh14
Explorer

question is two fold

question 1 -
here is sample log

|>messageType|2020-02-2 14:01:55.995|094a786b-4d07-498c-9c26-685aa4119a8f|unique_id|dir|not_unique|time|trxn|<?XML data>|

messageType and dir is interesting field from splunk.

here is my query
index=sample_index source="source_1" dir=In messageType=Web | rex field=_raw "^(?:[^\|\n]*\|){8}(?P<transactions>[^\|]+)"

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

question 2 -
from above log last part xml data. here is sample xml

<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns3:trxn
xmlns:ns2="url1"
xmlns:ns3="url2">
<ResponseCode>OK</ResponseCode>
</ns3:trxn>
</soapenv:Body>
</soapenv:Envelope>

how can I get trxn and responnseCode here?

Labels (1)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @ritesh14,

You can extract all in one regex;

^(?:[^\|\n]*\|){7}(?P<time>[^\|]+)\|(?P<transactions>[^\|]+)\|[^|]+<ResponseCode>(?P<responseCode>[^\<]+)[^|]+ns3:(?P<xml_trxn>[^\>]+)

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.

spammenot66
Contributor

@ritesh14In regards to the question below, can you give a n example of where you're expecting two values for trxn and time? this can be interpreted multiple ways.

 

 

This query works for single value like trxn here. but how to get two value trxn and time. I am looking for chart, table with avg(time) and trxn

0 Karma

ritesh14
Explorer

in very simplest term..I have the query for single term either time or trxn and it worked fine.

I was looking for both value at the same time - trxn and time. basically I wanted to create a table with trxn and time. I did build the query but interesting not properly working

 

here is the two query I have build the responseTime coming on both are different

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| stats min(responseTime) AS "MinResponseTime" avg(responseTime) AS "AVG_ResponseTime" max(responseTime) AS "MaxResponseTime" by trxn
| eval AVG_ResponseTime=round(AVG_ResponseTime,0)
| sort -AVG_ResponseTime | table trxn MinResponseTime AVG_ResponseTime MaxResponseTime

 

index=* source="/logs/*" direction=out CommType=messageType | rex field=_raw "^(?:[^\|\n]*\|){7}(?P<responseTime>[^\|]+)\|(?P<trxn>[^\|]+)"
| timechart span=1m avg(responseTime) by trxn

 

if someone can help me what is wrong here

 

0 Karma

ritesh14
Explorer

I got the problem statement

response times coming as comma separated value like 1,008 that is 1 sec and 8 ms.

how the splunk can parse comma separated digit as single INT?

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...