Reporting

Generate table from search result using wildcard

asitagr
New Member

spath "log.message" | search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*".

 

Then from the results, I want to trim the asterisk part of string and print a table with count eg.

log.messagecount
REQ_TRACK_ID_MISSING10
DESERIALIZATION_EXCEPTION12
SERIALIZATION_EXCEPTION 5

 

I tried so many functions including replace, trim.. but I'm not able to formulate the results as shown above.  How can we achieve this?

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I usually do that using a case expression.

spath "log.message" 
| search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*"
| eval logMessage = case(match("log.message","REQ_TRACK_ID_MISSING.*"),  "REQ_TRACK_ID_MISSING", match("log.message", "DESERIALIZATION_EXCEPTION.*"), "DESERIALIZATION_EXCEPTION", match("log.message", "SERIALIZATION_EXCEPTION.*"), "SERIALIZATION_EXCEPTION", 1=1, "log.message")
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!