Other Usage

Generate table from search result using wildcard

asitagr
New Member

spath "log.message" | search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*".

 

Then from the results, I want to trim the asterisk part of string and print a table with count eg.

log.messagecount
REQ_TRACK_ID_MISSING10
DESERIALIZATION_EXCEPTION12
SERIALIZATION_EXCEPTION 5

 

I tried so many functions including replace, trim.. but I'm not able to formulate the results as shown above.  How can we achieve this?

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I usually do that using a case expression.

spath "log.message" 
| search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*"
| eval logMessage = case(match("log.message","REQ_TRACK_ID_MISSING.*"),  "REQ_TRACK_ID_MISSING", match("log.message", "DESERIALIZATION_EXCEPTION.*"), "DESERIALIZATION_EXCEPTION", match("log.message", "SERIALIZATION_EXCEPTION.*"), "SERIALIZATION_EXCEPTION", 1=1, "log.message")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...