3

I'm a newbie as far as Splunk is concerned with modest regex skills.

We have events with the following patterns:

fallbackAPIStatus={api1=133:..., api2=472:...,api3=498:...}
fallbackAPIStatus={api1=3535:...}
fallbackAPIStatus={api2=252:...,api3=655:...}

The numeric value indicates the response times and the ellipsis inidcates fields that I'm not interested in.

The number of apis within the braces is dynamic (between 1 and 4)

I want to be able to create a table as follows:

apiName   TotalRequests  Max-Response-Time  Min-Response-Time 
api1           2            3535           133
api2           2             472           252
api2           2             655           498

Here's my search:

index=my_logs  sourcetype=my_sourcetype | rex field=_raw "fallbackAPIStatus=\{(?P<fallBackApis>[^\}]+)\}" | eval temp=split(fallBackApis,",") | rex field=temp "(?P<apiName>[a-zA-Z-]+)=(?P<responseTime>[0-9]+):"|stats count as TotalRequests  max(responseTime) as Max-Response-Time min(responseTime) as Min-Response-Time by apiName

I'm able to get the TotalRequests right but I'm not able to get the correct max and min response times

Can someone advise what I'm doing wrong here?

maverick2701
  • 31
  • 2

1 Answers1

1

I think there is an issue with your field extraction, the following works fine 

| eval temp=split(fallBackApis,",") | rex field=temp "(?<apiName>\S+)=(?<responseTime>\d+):"
Simon Duff
  • 2,631
  • 2
  • 7
  • 15