Other Usage

Generate table from search result using wildcard

asitagr
New Member

spath "log.message" | search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*".

 

Then from the results, I want to trim the asterisk part of string and print a table with count eg.

log.messagecount
REQ_TRACK_ID_MISSING10
DESERIALIZATION_EXCEPTION12
SERIALIZATION_EXCEPTION 5

 

I tried so many functions including replace, trim.. but I'm not able to formulate the results as shown above.  How can we achieve this?

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I usually do that using a case expression.

spath "log.message" 
| search "log.message"="REQ_TRACK_ID_MISSING*" OR "log.message" ="DESERIALIZATION_EXCEPTION*" OR "log.message" = "SERIALIZATION_EXCEPTION*"
| eval logMessage = case(match("log.message","REQ_TRACK_ID_MISSING.*"),  "REQ_TRACK_ID_MISSING", match("log.message", "DESERIALIZATION_EXCEPTION.*"), "DESERIALIZATION_EXCEPTION", match("log.message", "SERIALIZATION_EXCEPTION.*"), "SERIALIZATION_EXCEPTION", 1=1, "log.message")
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...