Now you see the importance of illustrating data accurately. My could only give you channel because the only data snippet I could see has channel. Now, you can see that accountNumber is a subnode in...
See more...
Now you see the importance of illustrating data accurately. My could only give you channel because the only data snippet I could see has channel. Now, you can see that accountNumber is a subnode in REQUEST.body.customer, serialNumber is a subnode in REQUEST.body.equipment, while redemptionEquipmentMemory and transactionReferenceNumber are those in RESPONSE.body.model. Your initial data snippet already established that Channel is a subnode in REQUEST.headers. All this is to say that to write the correct SPL, you need to understand data. Before trying to render results, use SPL to help analyze data. Now that you know where in the JSON structure each of those fields lies, you can just extract each node. But doing so usually is too laborious and not good for maintenance and enhancement. So, I will give a more flexible code index="wireless_retail" source="CREATE_FREEDOM.transactionlog" OPERATION="/FPC/Redemption/Redeem"
| rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO"
| spath input=REQUEST path=headers
| spath input=REQUEST path=body output=REQUEST
| spath input=RESPONSE path=body output=RESPONSE
| foreach headers REQUEST RESPONSE
[spath input=<<FIELD>>]
```| spath input=RESPONSE path=headers.set-cookie{}
| mvexpand headers.set-cookie{}```
| foreach customer equipment model
[rename <<FIELD>>.* AS *]
|table accountNumber serialNumber Channel redemptionEquipmentMemory transactionReferenceNumber This is an emulation of your sample data | makeresults
| eval _raw = "2024-05-02 23:40:22.000, ID=\"5e2276d3-7f02-7984-ad4b-e11507580872\", ACCOUNTID=\"5\", ACCOUNTNAME=\"prd\", APPLICATIONID=\"6\", APPLICATIONNAME=\"ws\", REQUEST=\"{\"body\":{\"customer\":{\"accountNumber\":\"DBC00089571590\",\"lineNumber\":\"8604338\"},\"equipment\":{\"serialNumber\":\"359938615394762\",\"grade\":\"A\"},\"redemptionDetails\":{\"redemptionDate\":\"20240502\",\"user\":\"WVMSKaul\",\"storeNumber\":\"WD227907\",\"dealerNumber\":\"2279\"}},\"headers\":{\"content-type\":\"application/json;charset=UTF-8\",\"Accept\":\"application/json;charset=UTF-8\",\"Channel\":\"6\",\"Locale\":\"en-US\",\"TransactionID\":\"65E5519B-F170-4367-AA03-54A33BA29B4E\",\"ApplicationID\":\"00000411\",\"Authorization\":\"Basic ZnJlZWRvbWNyZWF0ZTpDd0t4dGlmbGZ3ZnFaQVYydWhtUg==\"}}\", RESPONSE=\"{\"body\":{\"model\":{\"isRedeemed\":true,\"transactionReferenceNumber\":\"6200753992\",\"redeemType\":\"Original\",\"redemptionFailureReasonType\":null,\"redemptionEquipmentMake\":\"Samsung\",\"redemptionEquipmentModel\":\"Galaxy S21 FE 128GB Graphite\",\"redemptionEquipmentMemory\":\"128 GB\",\"committedPrice\":1,\"additionalFees\":0},\"code\":200,\"messages\":null,\"isSuccess\":true},\"headers\":{\"connection\":\"close\",\"content-type\":\"application/json;charset=utf-8\",\"set-cookie\":[\"AWSELB=B3A9CDE108B7A1C9F0AFA19D2F1D801BC5EA2DB758E049CA400C049FE7C310DF0BB906899FF431BCEF2EF75D94E40E95B107D7A5B122F6844BA88CEC0D864FC12E75279814;PATH=/\",\"AWSELBCORS=B3A9CDE108B7A1C9F0AFA19D2F1D801BC5EA2DB758E049CA400C049FE7C310DF0BB906899FF431BCEF2EF75D94E40E95B107D7A5B122F6844BA88CEC0D864FC12E75279814;PATH=/;SECURE;SAMESITE=None\",\"visid_incap_968152=gpkNFRF6QtKeSmDdY/9FWWUkNGYAAAAAQUIPAAAAAABmisXXPd3Y2+ulqGUibHZU; expires=Fri, 02 May 2025 07:12:03 GMT; HttpOnly; path=/; Domain=.likewize.com\",\"nlbi_968152=FnwQGi3rMWk+u+PCILjsZwAAAACniSzzxzSlwTCqfbP87/10; path=/; Domain=.likewize.com\",\"incap_ses_677_968152=2ZElDA77lnjppwgU8y9lCWUkNGYAAAAArXuktDctGDMtVtCwqfe5bw==; path=/; Domain=.likewize.com\"],\"content-length\":\"349\",\"server\":\"Jetty(9.4.45.v20220203)\"}}\", RETRYNO=\"0\", ENDPOINT=\"https://apptium.freedommobile.ca/Activation.TradeUp\", OPERATION=\"/FPC/Redemption/Redeem\", METHOD=\"POST\", CONNECTORID=\"0748a993-4566-48ae-9885-2a4dce9de585\", CONNECTORNAME=\"Likewize\", CONNECTORTYPE=\"Application\", CONNECTORSUBTYPE=\"REST\", STARTTIME=\"1714693218282\", ENDTIME=\"1714693222213\", RESPONSETIME=\"3931\", SUCCESS=\"1\", CLIENT=\"eportal-services\", CREATEDDATE=\"2024-05-02 23:40:22\", USERNAME=\"WVMSKaul@wmbd.local\", SESSIONID=\"_027c735b-30ed-472c-99e8-6d0748e5a7d9\", ACTIONID=\"5c0a6f88-5a1e-4fdc-a454-01c53fdc0b9b\", TRACKID=\"674e1eed-ba9e-429f-87fc-3b4773b7dd06\""
``` the above emulates
index="wireless_retail" source="CREATE_FREEDOM.transactionlog" OPERATION="/FPC/Redemption/Redeem"
``` The output from emulated data is accountNumber serialNumber Channel redemptionEquipmentMemory transactionReferenceNumber DBC00089571590 359938615394762 6 128 GB 6200753992 Finally, I want to illustrate the most inflexible implementation, custom extraction of the needed fields directly index="wireless_retail" source="CREATE_FREEDOM.transactionlog" OPERATION="/FPC/Redemption/Redeem"
| rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO"
| spath input=REQUEST path=headers.Channel output=Channel
| spath input=REQUEST path=body.customer.accountNumber output=accountNumber
| spath input=REQUEST path=body.equipment.serialNumber output=serialNumber
| spath input=RESPONSE path=body.model.redemptionEquipmentMemory output=redemptionEquipmentMemory
| spath input=RESPONSE path=body.model.transactionReferenceNumber output=transactionReferenceNumber
| table accountNumber serialNumber Channel redemptionEquipmentMemory transactionReferenceNumber Since 8.1, you can also implement these one-to-one extractions using json_extract. index="wireless_retail" source="CREATE_FREEDOM.transactionlog" OPERATION="/FPC/Redemption/Redeem"
| rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO"
| eval Channel = json_extract(REQUEST, "headers.Channel")
| eval accountNumber = json_extract(REQUEST, "body.customer.accountNumber")
| eval serialNumber = json_extract(REQUEST, "body.equipment.serialNumber")
| eval redemptionEquipmentMemory = json_extract(RESPONSE, "body.model.redemptionEquipmentMemory")
| eval transactionReferenceNumber = json_extract(RESPONSE, "body.model.transactionReferenceNumber")
| table accountNumber serialNumber Channel redemptionEquipmentMemory transactionReferenceNumber