Hi, If someone can help, My log file is as below : 2022.03.22 06:05:16 ["6c74f67eff58131d" "0e056f566ee8453bac585b95ab0a2eed"] [MainProcess] INFO Task completed in 39.15966860949993 ms. Return object {'requestId': 'cibilcreditscore/11109dac-a807-4022-9a48-471f717a88f1', 'entity': 'CIBIL_CHECK', 'results': {'BALANCE_MAX1_10000_SEC_EXT_WOE_INT': {'result': '-9999', 'version': 'v4'}, 'BALANCE_MEAN1_10000_APPROVED_AMT_MEAN1_10000_POS_EXT_WOE_INT': {'result': '-9999.0', 'version': 'v4'}, 'CIBIL_ACC_DTCLOSED_FIRSTCLEND': {'result': '-9999', 'version': 'v4'}, 'CIBIL_ACC_LIMIT_OPEN_REV': {'result': '-9999', 'version': 'v4'}, 'CIBIL_CC_AMTOVERDUE_SUM': {'result': '-9999', 'version': 'v4'}, 'CIBIL_DPD_LAST_5DPD': {'result': '-9999', 'version': 'v4'}, 'CIBIL_DPD_MAX_13_18_NUM': {'result': '-9999', 'version': 'v4'}, 'CIBIL_DPD_RATE_10DPD_3M': {'result': '-9999', 'version': 'v4'}, 'CIBIL_ENQ_CNT_90D': {'result': '-9999', 'version': 'v4'}, 'CIBIL_ENQ_LN_NOHC_CNT_24M': {'result': '3', 'version': 'v4'}, 'CIBIL_ENQ_NOHC_TMSNC_LAST': {'result': '0', 'version': 'v4'}, 'CIBIL_NOHC_INSTL_PAID_NORMALLY_60M': {'result': '-9999', 'version': 'v4'}, 'CIBIL_P_OCCUPATION': {'result': 'N/A', 'version': 'v4'}, 'CIBIL_SCORE': {'result': '150.0', 'version': 'v4'}, 'DPD_NUM_ADJ_MAX1_10000_MEAN1_10000_SEC_EXT_WOE_INT': {'result': '-9999.0', 'version': 'v4'}, 'DPD_NUM_ADJ_MEAN1_10000_EXT_WOE_INT': {'result': '-9999.0', 'version': 'v4'}, 'FLAG_Cons_Loan_SUM1_EXT': {'result': '1', 'version': 'v4'}, 'FLAG_ENQ_ANY_SUM1_90_EXT': {'result': '3', 'version': 'v4'}, 'TS_ENQ_F_D': {'result': '19', 'version': 'v4'}, 'TS_OPEN_DT_F_SEC_CLS_D_EXT': {'result': '-9999', 'version': 'v4'}, 'TS_OPEN_DT_F_SEC_STAT_UNIF_CLSD_D_EXT_WOE_INT': {'result': '-9999', 'version': 'v4'}, 'cbActiveEmi': {'result': '-9999', 'version': 'v3'}, 'cbDisposableIncome': {'result': '-9999', 'version': 'v2'}, 'cbDpdMax18mNum': {'result': '-9999', 'version': 'v4'}, 'cbDpdRate1Dpd12m': {'result': '-9999', 'version': 'v4'}, 'cbEnqCnt90d': {'result': '-9999', 'version': 'v4'}, 'cbEstimatedIncome': {'result': '-9999', 'version': 'v3'}, 'ciAccVehClosedCnt': {'result': '-9999', 'version': 'v2'}, 'ciAmountMax1180Mean1180': {'result': '2.5141069333482315', 'version': 'v6'}, 'ciAmountMean110000': {'result': '59663.333333333336', 'version': 'v6'}, 'ciAmtOverdue2BalSum90': {'result': '-9999.0', 'version': 'v7'}, 'ciAmtOverdue2FaOvdRtExt': {'result': '-9999', 'version': 'v2'}, 'ciAmtOverdueSum1360': {'result': '-9999', 'version': 'v4'}, 'ciBalanceMax110000Sec': {'result': '-9999', 'version': 'v4'}, 'ciBalanceMean1360Cl': {'result': '-9999.0', 'version': 'v4'}, 'ciBalanceMeanCl': {'result': '-9999.0', 'version': 'v6'}, 'ciCbAccTenureSum': {'result': '-9999', 'version': 'v6'}, 'ciCntRestructure': {'result': '0', 'version': 'v2'}, 'ciDpd15EverPct': {'result': '-9999', 'version': 'v2'}, 'ciDpdCntNoOvdEver': {'result': '-9999', 'version': 'v2'}, 'ciDpdMeanClsd': {'result': '-9999.0', 'version': 'v6'}, 'ciDpdNumAdjMax110000Mean110000': {'result': '-9999.0', 'version': 'v4'}, 'ciDpdNumAdjMax1360': {'result': '-9999.0', 'version': 'v4'}, 'ciDpdNumAdjMax190': {'result': '-9999.0', 'version': 'v4'}, 'ciDpdNumAdjMean110000Clsd': {'result': '-9999.0', 'version': 'v4'}, 'ciEnqAmtMax2Mean180': {'result': '2.5141069333482315', 'version': 'v6'}, 'ciEnqAmtMeanEver': {'result': '59663.333333333336', 'version': 'v6'}, 'ciEnqCnt360': {'result': '3', 'version': 'v6'}, 'ciFlagConsLoanSum110000Ext': {'result': '1', 'version': 'v4'}, 'ciFlagEnqAnySum190Ext': {'result': '3', 'version': 'v4'}, 'ciLastOverdueMonthCntPos': {'result': '-9999', 'version': 'v2'}, 'ciTsEnqFD': {'result': '19', 'version': 'v4'}, 'ciTsEnqLD': {'result': '8', 'version': 'v4'}, 'ciTsFDpdNumAdj00D': {'result': '-9999.0', 'version': 'v4'}}, 'cuid': 27040685}; Timestamp of request: 2022-03-22 06:05:13.618000 Using the below reg ex to match and count NULL vs NOT NULL, NULL are represented as { 'result': '-9999.0',... or {'result': '-9999', ... index = "index" return object | rex "\s*\'(?<feature>[^\']+)\':\s+\{\'result\':\s+\'(?<result>[^\']+)" | eval type="cnt_".feature."_".if((result="-9999" OR result="-9999.0"),"NULL","NOT_NULL") | bin _time span=1d | stats count(eval(result="-9999" OR result="-9999.0")) AS NULL count(eval(result!="-9999" AND result!="-9999.0")) AS NOT_NULL count AS total BY _time type | eval perc_null=(NULL/total)*100, perc_not_null=(NOT_NULL/total)*100 The problem is the regular expression is not matching all of the features, for example it is not matching cbEstimatedIncome, ciCntRestructure, even though in this tool : https://regex101.com/r/q2bKfP/1 it is shown as matching. I am struggling with Splunk, any help is appreciated.
... View more