This is working. adding | table filename after rex fixed it.   | rex "\[INFO\]\s+\S+\s+(?<filename>\S+)\s" | table filename ... View more

Not working though. Returning the same result ... View more

please check the attached picture. It has the command you suggested me to run with the OP ... View more

Please check the attached screenshot ... View more

@ITWhisperer ,      I still couldn't figure it out to get this work. Tried using rex with different possibilities but none of them are working. can you please suggest a better solution?   Thanks.  ... View more

@richgalloway  source=/aws/lambda/sample test.json  source=/aws/lambda/sample test.json | rex "\.\d{3}\w+\s(?<file>\S+)" Both the above commands returning the same result as below. Logs are: [INFO] 2021-10-02T00:09:50.398Z 12345 {"Records": [{"eventVersion": "2.1", "eventSource": "aws:s3", "awsRegion": "us-east-1", "eventTime": "2021-10-02T00:09:42.743Z", "eventName": "ObjectCreated:Put", "userIdentity":   Adding the rex to extract and display the '12345' not working in my scenario. do wee need to update rex command? Thanks.   ... View more

the full query is looks like below: I am looking for source lambda logs with a json file to return a reqid.  source=/aws/lambda/sample test.json | rex "\.\d{3}\w+\s(?<file>\S+)"   In log events it returns a reqid '12345' as below. There is some space after timestamp and after reqid. Logs are:   [INFO] 2021-10-02T00:09:50.398Z 12345 {"Records": [{"eventVersion": "2.1", "eventSource": "aws:s3", "awsRegion": "us-east-1", "eventTime": "2021-10-02T00:09:42.743Z", "eventName": "ObjectCreated:Put", "userIdentity":   I hope this is clear now. let me know if i need to add extra details   ... View more

@richgalloway    I have tried it as you suggested. But its returning the same result as before.  I have pasted the logs below. I have to remove the timestamp and return the just 12345 as the output.   Logs are:   [INFO] 2021-10-02T00:09:50.398Z 12345 {"Records": [{"eventVersion": "2.1", "eventSource": "aws:s3", "awsRegion": "us-east-1", "eventTime": "2021-10-02T00:09:42.743Z", "eventName": "ObjectCreated:Put", "userIdentity": ... View more

I have tried it as you suggested. But its returning the same result as before.  I have pasted the logs below. I have to remove the timestamp and return the just 12345 as the output.   Logs are:   [INFO] 2021-10-02T00:09:50.398Z 12345 {"Records": [{"eventVersion": "2.1", "eventSource": "aws:s3", "awsRegion": "us-east-1", "eventTime": "2021-10-02T00:09:42.743Z", "eventName": "ObjectCreated:Put", "userIdentity": ... View more

Thanks. It worked 👏 ... View more

I came across this approach when i was looking for solution. So i just gave a try to check if it works. I am still looking for the solution for this issue. I am really not sure what else i can try  ... View more

can you please share some examples i can try with?   Thanks. ... View more

I tried using subsearch for the same as below. For some reason its not working with sub query.  The overall query for subsearch is, query 2 is, [search sourcetype=sample*-cloudwatch-logs file.txt | rex "RequestId: (?<reqid>[\S+]*)\s" | table reqid | dedup reqid] | rex "uploaded to: s3:\/\/sample.*?-test-.*?-us-east-1-s3/(?<json>.*)" | table json | where isnotnull(json) query 1 is, [search sourcetype=sample*-cloudwatch-logs file.txt | rex "RequestId: (?<reqid>[\S+]*)\s" | table reqid | dedup reqid]   Its not returning anything in splunk search. ... View more

@somesoni2         Yes, thats right. It always returns Only one row with one field. How can i make my queries better to get the result i need?   Thank you so much for the response.   Thanks. ... View more

@richgalloway ,    I tried as you suggested. Below is the screen shot of running two commands as one in splunk search. It doesn't return anything. (same query runds through dashboard). Its taking the command as whole instaed of running first query and then pass it as an input to second query. The code looks like this in xml file:     <row> <panel> <table> <search id="base"> <query>sourcetype=sample*-cloudwatch-logs file.txt | rex "RequestId: (?&lt;reqid&gt;[\S+]*)\s" | table reqid | dedup reqid</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> <row> <panel> <table> <search base = "base"> <query>| rex "uploaded to: s3:\/\/sample.*?-test-.*?-us-east-1-s3/transmit-os/(?&lt;filename&gt;.*)" | table filename</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row>     Please check and let me know what else i can do to make it work. Also, please check the attached pic of splunk running in my UI.   Thanks.   ... View more

@richgalloway ,      The two queries are working individually great. Also I tried as you suggested , but its not returning anything. Even if running two queries together in splunk search not working. Can you please suggest in any another way i can pass the output of first query as an input to the second query? I appreciate your help.   Thanks. ... View more

Thanks Rich. That worked ... View more

hi @richgalloway ,     Thanks for replying to my post. Yes, this query really helps me and get the file name i need. One question is that, values in URL names are dynamic and changes with environment (dev, qa,  uat etc) and client name (client1, client2 etc). How can i over come that? The command that working for me for static values in URL: rex "uploaded to: s3://<client>-sample-<env>-us-east-1-s3/path/(?<filename>.*)" | table filename   In above command, client(client1, client2 and client3) and env(dev, qa and uat) values changes. How can i over come that?  If i pass '*' for the env and client names query not returning anything.   Thanks. ... View more

I solved this issue by correcting the type of the dashboard as query. ... View more