×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sarathi125
Explorer
Member since: ‎12-30-2024
‎01-01-2025
Community Statistics
Posts 4
Solutions 1
Karma Given 0
Karma Received 0
Member Since ‎12-30-2024
View All

Re: How to use the regex matched variables from th...

by in Splunk Search
‎01-01-2025 05:52 PM
‎01-01-2025 05:52 PM
Hi @bowesmana, With the below query able to achieve what I have tried to get,  Thank you for your input.   index="<index>" (source="user1" OR source="user2") "The transaction reference id is" | rex field=_raw "\"jobId\":\s?\"(?<jobId>[a-fA-F0-9\-]+)\"" | join jobId [ search index="<index>" (source="user1" OR source="user2") ("<ProcessName>" AND "Exception occurred") | rex field=_raw "\"jobId\":\s?\"(?<jobId>[a-fA-F0-9\-]+)\"" | table jobId, _time, _raw ] | table _time, jobId, _raw     ... View more

Re: How to use the regex matched variables from th...

by in Splunk Search
‎12-31-2024 07:09 AM
‎12-31-2024 07:09 AM
@isoutamo, No, I have not tried with spath, Could you please guide me with that.   I tried with the below, its showing events, but not getting the transaction level information index="<indexname>" source = "user1" OR source = "user2" "<ProcessName>" "Exception occurred" | spath | table _time JobId TransactionId _raw | search JobId=* | append [ search index="<indexname>" source = "user1" OR source = "user2" | spath | search JobId=* | table _time JobId TransactionId _raw ] | stats dc(TransactionId) as UniqueTransactionCount values(TransactionId) as UniqueTransactions by JobId ... View more

Re: How to use the regex matched variables from th...

by in Splunk Search
‎12-31-2024 06:11 AM
‎12-31-2024 06:11 AM
@bowesmana, I have tried with that, but not getting any results. Actually I am trying to match the jobid from the below message. And using this jobId I have get other records which are all matching with this jobid   ... View more

How to use the regex matched variables from the fi...

by in Splunk Search
‎12-30-2024 06:00 PM
‎12-30-2024 06:00 PM
Hi All, I am searching UiPath Orchestrator Logs in Splunk as following:   index="<indexname>" source = "user1" OR source = "user2" "<ProcessName>" "Exception occurred" | rex field=message "(?<dynamic_text>jobId:\s*\w+)" | search dynamic_text!=null | stats values(dynamic_text) AS extracted_texts | map search="index="<indexname>" source = "user1" OR source = "user2" dynamic_text=\"$extracted_texts$\""   with my above search, I'll have to reference the jobId matched field from the first search to get other matching records to process transaction details Thanks a lot in advance! ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎01-01-2025 10:50 PM