Hi, I have my messages like below msg: abc.com - [2023-11-24T18:38:26.541235976Z] "GET /products/?brand=ggg&market=ca&cid=5664&locale=en_CA&pageSize=300&ignoreInventory=false&includeMarketingFlagsDetails=true&size=3%7C131%7C1%7C1914&trackingid=541820668241808 HTTP/1.1" 200 0 47936  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "10.119.25.242:59364" "10.119.80.158:61038" x_forwarded_for:"108.172.104.40, 184.30.149.136, 10.119.155.154, 10.119.145.54,108.172.104.40,10.119.112.127, 10.119.25.242" x_forwarded_proto:"https" vcap_request_id:"faa6d72c-4518-4847-47b2-0b340bb27173" response_time:0.455132 gorouter_time:0.000153 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"41" instance_id:"5698b714-359f-4906-742e-2bd7" x_cf_routererror:"-" x_b3_traceid:"042db9308779903a607119a204239679" x_b3_spanid:"b6e3d71259e4c787" x_b3_parentspanid:"607119a204239679" b3:"1188a5551d8c70081e69521568459a30-1e69521568459a30" msg: abc.com - [2023-11-24T18:38:25.779609363Z] "GET /products/?brand=hhh&market=us&cid=1185233&locale=en_US&pageSize=300&ignoreInventory=false&includeMarketingFlagsDetails=true&department=136&trackingid=64354799847524800 HTTP/1.1" 200 0 349377 "Mozilla/5.0 (iPhone; CPU iPhone OS 16_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Mobile/15E148 Safari/604.1" "10.119.25.155:53702" "10.119.80.152:61026" x_forwarded_for:"174.203.39.239, 23.64.120.177, 10.119.155.137, 10.119.145.11,174.203.39.239,10.119.112.37, 10.119.25.155" x_forwarded_proto:"https" vcap_request_id:"d1628805-0307-4bf7-7d8d-b1fa3a829986" response_time:1.211096 gorouter_time:0.000257 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"180" instance_id:"8faf9328-b05d-4618-7d12-96e6" x_cf_routererror:"-" x_b3_traceid:"06880ee3e5ad85b36dd3f4e64337a842" x_b3_spanid:"acb1620e517eebec" x_b3_parentspanid:"6dd3f4e64337a842" b3:"06880ee3e5ad85b36dd3f4e64337a842-6dd3f4e64337a842" msg: abc.com - [2023-11-24T18:38:26.916331792Z] "GET /products/?cid=1127944&department=75&market=us&locale=en_US&pageNumber=1&pageSize=60&trackingid=6936C9BF-D9DD-4D77-A14F-099C0400345D&brand=lll HTTP/1.1" 200 0 48615 "-" "browse" "10.119.25.172:51116" "10.119.80.139:61034" x_forwarded_for:"10.119.80.195, 10.119.25.172" x_forwarded_proto:"https" vcap_request_id:"a3125da7-a602-4e17-6656-909f380c12ed" response_time:0.068075 gorouter_time:0.000737 app_id:"1ae5e787-31d1-4b6a-aa7a-1ff7daed2542" app_index:"156" instance_id:"4f44c63e-44c6-4605-7466-fe5d" x_cf_routererror:"-" x_b3_traceid:"731b434ec32bb0eb6236fd4a8b8e1195" x_b3_spanid:"6236fd4a8b8e1195" x_b3_parentspanid:"-" b3:"731b434ec32bb0eb6236fd4a8b8e1195-6236fd4a8b8e1195" Iam trying to extract values brand market and cid from above url with below query  index = dd | rex field=_raw "brand=(?<brand>[^&]+)" | rex field=_raw "market=(?<market>[^&]+)" | rex field=_raw "cid=(?<cid>\d+)" | table brand, market, cid but I get the whole url after brand= getting extracted, not just brand market and cid values. Please help ... View more

Hi, I have below kind of messages Received abc message Error processing abc message Received def message Received ghi message Received ghi message Error processing ghi message   I am looking for an output like below Topic recievedcount erroredcount  abc         1                            1 def           1                           0 ghi            2                            1   I tried below  index="foo" "Received" OR "Error processing" | rex "Received (?<a>.*) message" | rex "Error processing (?<b>.*) message" | stats count(a) as received, count(b) as errored  by a But the problem is want my topic on first column which is there in 2 different fields  a and b and cannot group by value. Any help on this is appreciated   ... View more

Hi, I have below message and Iam trying to use rex to extract the id... But myid always shows empty.. Please help - - [02/Nov/2022:17:43:03 -0400] "PUT /application/resources/cat/v7/product/1234567890003/status HTTP/1.1" 201 - abcd.com - 8 web-614   rex field=msg "/application/resources/cat/v7/product/(?<myid>[0-9]*)/status" | table myid   ... View more

Hi, Iam trying a simple query where i want to see the percentage of calls with a particular response time in splunk and somehow the percent field is coming as empty in the table.   index = xyz http_status=200 | stats count(request_ms) as web-calls by request_ms | eventstats sum(web-calls) as totalwb |eval percent=(web-calls*100/totalwb) | table request_ms web-calls totalwb percent ... View more