Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About siksaw33
siksaw33
Path Finder
Member since:
04-29-2022
06-21-2023
Community Statistics
| Posts | 23 |
| Solutions | 0 |
| Karma Given | 6 |
| Karma Received | 0 |
| Member Since | 04-29-2022 |
Activity Feed
- Karma Re: How to extract nested JSON fields and array from Splunk data using spath? for yuanliu. 06-21-2023 01:12 PM
- Posted Re: How to extract nested JSON fields and array from Splunk data using spath? on Splunk Search. 06-20-2023 05:01 PM
- Posted Re: How to extract nested JSON fields and array from Splunk data using spath? on Splunk Search. 06-20-2023 04:48 PM
- Posted Re: Extracting Nested JSON Fields and Array from Splunk Data Using spath on Splunk Search. 06-19-2023 02:09 PM
- Posted Re: Extracting Nested JSON Fields and Array from Splunk Data Using spath on Splunk Search. 06-19-2023 01:17 PM
- Posted Re: Extracting Nested JSON Fields and Array from Splunk Data Using spath on Splunk Search. 06-19-2023 01:15 PM
- Posted Re: Extracting Nested JSON Fields and Array from Splunk Data Using spath on Splunk Search. 06-19-2023 11:10 AM
- Posted How to extract nested JSON fields and array from Splunk data using spath? on Splunk Search. 06-19-2023 10:06 AM
- Karma Re: Help with Regex extraction from request for yuanliu. 01-16-2023 08:45 AM
- Karma Re: Help with Regex extraction for gcusello. 01-12-2023 06:26 AM
- Karma Re: Help with Regex extraction for yuanliu. 01-12-2023 06:26 AM
- Posted Re: Help with Regex extraction on Splunk Search. 01-12-2023 06:25 AM
- Posted Re: Help with Regex extraction from request on Splunk Search. 01-09-2023 02:04 PM
- Posted Re: Help with Regex extraction from request on Splunk Search. 01-09-2023 12:48 PM
- Posted Re: Help with Regex extraction on Splunk Search. 01-09-2023 10:48 AM
- Posted Re: Help with Regex extraction from request on Splunk Search. 01-09-2023 10:13 AM
- Posted Help with Regex extraction from request on Splunk Search. 01-09-2023 09:32 AM
- Posted Help with Regex extraction on Splunk Search. 01-09-2023 09:14 AM
- Posted Re: JSON Regex extraction on Splunk Search. 05-31-2022 07:19 AM
- Karma Re: JSON Regex extraction for ITWhisperer. 05-31-2022 07:11 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
06-20-2023
05:01 PM
I can post another question if this reply is too complicated
... View more
06-20-2023
04:48 PM
@ITWhisperer and @yuanliu sorry I am a Splunk Noob, can you please update your query, this is the entire JSON {
"functionAddress":"Function.v1/3.5.0",
"responseTime":15,
"httpStatus":200,
"additionalParameters":{
"locale":"en-US",
"channel":"WEB",
"accountToken":"Token1",
"productType":"Product1",
"primaryAccountToken":"Token1",
"programTier":"Tier1",
"programType":"Program1",
"accountBalance":"3722494",
"accountStatus":"ACTIVE",
"relationShipStatus":"ACTIVE",
"numberOfLinkedAccounts":14,
"basic":true,
"primary":true
},
"response":[
{
"status":{
"code":"0000",
"message":"SUCCESS"
},
"accountToken":"Token1",
"accountIdentifier":"1M06093364",
"accountStatus":"ACTIVE",
"programCode":"Code1",
"programTier":"Tier1",
"tierDescription":"Tier First",
"programType":"Program1",
"currentBalance":{
"currencyType":"POINTS",
"value":3722494
},
"accountBalance":{
"availableBalance":[
{
"type":"POINTS",
"name":"POINTS",
"pointCount":"3722494"
}
]
},
"enrollmentIndicator":true,
"redemptionIndicator":true,
"accountAuthorized":true,
"featureSetIdentifier":"PR",
"relationships":[
{
"accountToken":"Token2",
"primary":false,
"status":"ACTIVE",
"displayAccountNumber":"91115",
"productRelationshipType":"Product2"
},
{
"accountToken":"Token3",
"primary":false,
"status":"CANCELLED",
"displayAccountNumber":"91016",
"productRelationshipType":"Product3"
},
// more relationship objects here
],
"locale":"en-US",
"isBasic":true
}
]
}
... View more
06-19-2023
02:09 PM
@ITWhispererI forgot to mention that the message is the base JSON message {
"functionAddress": "ReadAccounts.v1/3.5.0",
"responseTime": 15,
"httpStatus": 200,
"additionalParameters": {
"locale": "en-US",
"accountToken": "XYZ123ABC456",
"productType": "CARD_ACCOUNT",
"primaryAccountToken": "XYZ123ABC456",
"accountBalance": "3722494",
"accountStatus": "ACTIVE",
"relationShipStatus": "ACTIVE",
"numberOfLinkedCards": 14,
"primary": true
},
"response": "[{\"status\":{\"code\":\"0000\",\"message\":\"SUCCESS\"},\"accountToken\":\"XYZ123ABC456\",\"accountIdentifier\":\"1M06093364\",\"accountStatus\":\"ACTIVE\",\"relationships\":[{\"accountToken\":\"XYZ789GHI012\",\"primary\":false,\"status\":\"ACTIVE\",\"displayAccountNumber\":\"91115\",\"productRelationshipType\":\"ACCOUNT\"},{\"accountToken\":\"JKL345MNO678\",\"primary\":false,\"status\":\"ACTIVE\",\"displayAccountNumber\":\"91107\",\"productRelationshipType\":\"ACCOUNT\"}]}]"
}
... View more
06-19-2023
01:17 PM
@ITWhispereror if you can share the link for runanywhere too
... View more
06-19-2023
01:15 PM
@yuanliuand @gcusello if you can review
... View more
06-19-2023
11:10 AM
nope still everything (the event) is ONLY appearing in 'message' and I get Field 'relationships' does not exist in the data.
... View more
06-19-2023
10:06 AM
I'm trying to extract some information from nested JSON data stored in Splunk. Here's a simplified and anonymized example of the type of data I'm dealing with:
{
"functionAddress": "ReadAccounts.v1/3.5.0",
"responseTime": 15,
"httpStatus": 200,
"additionalParameters": {
"locale": "en-US",
"accountToken": "XYZ123ABC456",
"productType": "CARD_ACCOUNT",
"primaryAccountToken": "XYZ123ABC456",
"accountBalance": "3722494",
"accountStatus": "ACTIVE",
"relationShipStatus": "ACTIVE",
"numberOfLinkedCards": 14,
"primary": true
},
"response": "[{\"status\":{\"code\":\"0000\",\"message\":\"SUCCESS\"},\"accountToken\":\"XYZ123ABC456\",\"accountIdentifier\":\"1M06093364\",\"accountStatus\":\"ACTIVE\",\"relationships\":[{\"accountToken\":\"XYZ789GHI012\",\"primary\":false,\"status\":\"ACTIVE\",\"displayAccountNumber\":\"91115\",\"productRelationshipType\":\"ACCOUNT\"},{\"accountToken\":\"JKL345MNO678\",\"primary\":false,\"status\":\"ACTIVE\",\"displayAccountNumber\":\"91107\",\"productRelationshipType\":\"ACCOUNT\"}]}]"
}
The response field is a JSON string that contains an array (even if there's only one element). Inside this array, there's a relationships array that can contain multiple elements.
I'm trying to extract the accountToken, accountIdentifier, accountStatus fields and all the relationships from this data into a table. So far, I've tried the following query but it doesn't seem to work as expected:
index=my_index ReadAccounts relationshipStatus en-US CANCELLED
| spath input=response path={}.accountToken output=accountToken
| spath input=response path={}.accountIdentifier output=accountIdentifier
| spath input=response path={}.accountStatus output=accountStatus
| spath input=response path={}.relationships{} output=relationships
| mvexpand relationships
| rename relationships as _raw
| spath input=_raw path=accountToken output=relationship_accountToken
| spath input=_raw path=primary output=relationship_primary
| spath input=_raw path=status output=relationship_status
| spath input=_raw path=displayAccountNumber output=relationship_displayAccountNumber
| spath input=_raw path=productRelationshipType output=relationship_productRelationshipType
| table _time, message, accountToken, accountIdentifier, accountStatus, relationship_accountToken, relationship_primary, relationship_status, relationship_displayAccountNumber, relationship_productRelationshipType
| head 10
When I run this query, the table appears blank, except for the _time column and everything is still in message. Could someone please advise what might be going wrong and how I can correct it? I'm trying to extract each relationship as its own row in the table.
Thank you in advance for any help you can provide.
... View more
Labels
- Labels:
-
field extraction
01-09-2023
02:04 PM
Thank you but I still get the same error with the new solution @richgalloway
... View more
01-09-2023
12:48 PM
@richgalloway This gives me error Error in 'rex' command: Encountered the following error while compiling the regex 'adsId\\":\\"(?<adsId>[^\]+)': Regex: missing terminating ] for character class. do I use the same one for other fields? just replace adsID with offerName etc? also how did you build the regex any knowledge resource or link you can share? how do I learn that so I can be helped by the community?
... View more
01-09-2023
10:48 AM
FYI I used rex field=_raw "userId\\\\\":\\\\\"(?<userId>[a-z]+)" for this
... View more
01-09-2023
10:13 AM
Nothing. I am a noob, non-technical PM. I want to learn splunk search, if you can share a beginners link and also please help solve this that would be great. @richgalloway
... View more
01-09-2023
09:32 AM
please help extract adsId,offerName, currentProductDescription, offerAccountToken, offerType, offerIdentifier message={"name":"com. ","level":"info","message":"Create -->|Request identifier : 09accf30-6cf7-4e4f-a633-c19808eff766|CreateAccountOfferEnrollment.v1|REQUEST ---> {\"correlationId\":\"09accf30-6cf7-4e4f-a633-c19808eff766\",\"ccpId\":\"HA6952B\",\"callId\":\"0109\",\"adsId\":\"camar\",\"customerId\":\"63038\",\"eventType\":\"CVP-INSTANT\",\"channelIdentifier\":\"CVP\",\"lineOfBusiness\":\"CCSG\",\"offerName\":\"Additional\",\"offerIdentifier\":\"A000\",\"sourceProductCode\":\"2X\",\"currentProductIdentifier\":\"2X\",\"currentProductDescription\":\"Pl\",\"destinationProductCode\":\"2X\",\"destinationProductName\":\"Plat\",\"fulfillmentCode\":\"GNAS\",\"requestHasSupps\":true,\"offerType\":\"consumer-stand-alone-supp\",\"offerAccountToken\":\"YAS\",\"marketName\":\"US\",\"numberOfSupps\":1,\"calledInAccountToken\":\"YAS\",\"fullName\":{\"firstName\":\"M\",\"lastName\":\"C\",\"middleName\":\"A\",\"prefix\":\"\",\"suffix\":\"\"},\"communicationInformation\":{\"channel\":\"EMAIL\",\"communicationVariables\":[],\"locale\":\"en_US\",\"physicalAddress\":{\"city\":\"P\",\"state\":\"FL\",\"zipCode\":\"33\",\"lines\":[\"48 \",\"#0114\",\"\"]},\"emailAddress\":\"cru@gmail.com\",\"isoCountryCode\":\"840\"},\"enrollmentInformation\":{\"id\":\"2023\",\"is_customer_offline\":false,\"channel_received_datetime\":\"20230109T171713.842 GMT\",\"dynamic_journey\":\"DYNAMIC_INSTANT\",\"rep_id\":\"HA6952B\",\"country_code\":\"840\",\"journey\":\"INSTANT_DECISION\",\"journey_stage\":\"SUPP",\"applicants\":[{\"number\":0,\"amex_relationship\":{\"relationships\":[{\"number\":\"3726\",\"type\""CARD\"}]},\"type\""PRIMARY\"},{\"number\":1,\"type\""NONPRIMARY\",\"has_spending_limit\":false,\"is_signature_available\":true,\"has_cash_restriction\":false,\"experience_id\""829e34d6-e89f-422b-b355-811b1aa2c79c\",\"names\":[{\"language\""EN\",\"name\":{\"first\""V\",\"last\""C\"}}],\"identifiers\":[{\"system\""DELIVERY_METHOD_IDENTIFIER\",\"id\""510DELVIDP256Cn+ has_same_address_as_primary\":false,\"emboss_name\""V\",\"language\""EN\",\"birth_date\""19\",\"spending_limit\":0,\"experience_choices\":[{\"selected_id\""USA_CONSUMER \",\"feature_name\""CARD_DESIGN\"}],\"product\":{\"offer_arrangement_id\""de7c960c46c7\",\"source_code\""A0000FYC4T\",\"short_product_id\""L81\",\"sub_product_code\""2X\"},\"addresses\":[{\"type\""HOME\",\"address\":{\"line1\""7B\",\"city\""HOUSTON\",\"region\""TX\",\"postal_code\""77028-4570\",\"country\""840\"}},{\"type\""TEMPORARY_ADDRESS\",\"address\":{\"line1\""790\",\"city\""HO\",\"region\""T\",\"postal_code\""77\",\"country\""840\"}}]}]},\"misProcessId\""3016428984\"}"} @ITWhisperer @VatsalJagani please help
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
01-09-2023
09:14 AM
2023-01-09T16:46:00.780076351Z app_name=default-java environment=e3 ns=one pod_container=default-java pod_name=default stream=stdout message={"name":"com","timestamp":"2023-01-09T16:46:00.779Z","level":"info","schemaVersion":"0.1","application":{"name":"com ","version":"1.2.5"},"request":{"address":{"uri":"Read/1.2.5"},"metadata":{"one-data-correlation-id":"d5d3 ","one-data-trace-id":"0be"}},"message":"Parent Function Address: Read, Request identifier: d5d35c6e-3661-4445-bbe4-f5a3f382d035, REQUEST-RECEIVED: {\"requestIdentifier\""d5 \",\"clientIdentifier\""CUST \",\"locale\""en-US\",\"userId\""lkapla\",\"accountNumber\""1234\",\"treatmentsFilter\":[\"targeted\",\"messages\"],\"callerType\""ADDTL\",\"cancelType\""\",\"handle\""gsp00a79e6b_b610_3407_90fa_11d5417c0b7f\",\"callTimeStamp\""1/9/2023 9:46:00 AM\",\"callIdentifier\""01091\",\"geoTelIdentifier\""04ba\"}, "} I want to extract the time, userid and clientIdentifier in a table?
... View more
Labels
- Labels:
-
field extraction
-
regex
-
rex
05-31-2022
07:19 AM
Thank you this worked! @ITWhisperercould you please explain | rex "properties\":\s*(?<properties>\{.*?\})" in this example | rex "OutboundWebHookPayload=(?<json>\{.*\})" and in the previous example https://community.splunk.com/t5/Splunk-Search/Help-with-JSON-Regex-extraction/m-p/599795#M208765 how are they different? how do I learn to build these myself?
... View more
05-30-2022
01:05 PM
Similar to
https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-all-fields-from-userdata/m-p/596078#M207501
Could you please help me with this I use
source=http:splunk_ecp_IPC2_kafka_logs sourcetype=yo_kafka_logs properties YoRouterLoggingInterceptor | rex "properties=(?\{.*\})" |table chatOriginUrl,firstName,lastName, conversationId,clientSourceId,engagedHandler
The string is
30 May 2022 08:38:20,741 log_level='DEBUG' thread_name='yoRouterExecutor-9' hostName=yo-router-b-deployment-39-gb2hf class_name='com.al.wsgcat.ngsp.yo.logging.YoRouterLoggingInterceptor' app=NGSPYO event_name=YOROUTER correlationId=BLiLDEyd-24052022-070434975 URI=https://yo.al.com/yo/gateway/v1/handleRouting,Method=POST,Headers=[Accept:"application/json", Content-Type:"application/json", Content-Length:"2388"],Request body={"yoMessage":{"messageText":"Representative has disconnected","from":null,"to":"mglueck@ngspchattims.al.com","properties":{"lineOfBusiness":"MYCA","messageCategory":"returningasync","messageCount":"","yoId":"svc.yo7@ngspchattims.al.com/Smack","transferIntentCode":"","experience":"platinum","checkoutStatus":"","customerMemberConnectionId":"44f4d6263627d8267385ea64d8bfc057","requestHandler":"","messageType":"ccpdisconnected","browserVersion":"Chrome 101.0.4951.61","action":"","workGroupName":"Social_Media_Team","chatType":null,"aao_locale":"en-US","microBotIntent":null,"deviceType":"mobile","applicationVersion":"1.0","interactionId":"159MS6U2J6NFHGP4","clientSourceId":"smrt","deviceOS":"Android 12","chatOriginUrl":"https://online.al.com/myca/mycaassist/us/startChat.do?request_type=authreg_home","messageId":"f3b5c925-2ac9-41a5-9917-41b0edb9e065","chatSessionId":"s_675f1a75-94b7-4e02-a240-94ef07b25c6e","masterBotIntent":null,"messageOrigin":"ccp","firstName":"J","userGroups":"","intentCode":"offers_generic","alSession":"","bbv":"6cf84eea-a1270454-e62fd5be-273cb071","smallCustomerArt":"","escalationIndicator":"","customerNumber":"CRPXMSYRO9UK7P3","riskflag":"","queuedTimeStamp":"","toId":"svc.yo24@ngspchattims.al.com/Smack","lastName":"","conversationHeader":"","customerProduct":"137","correlation-id":"f3b5c925-2ac9-41a5-9917-41b0edb9e065","channel-user-id":"44f4d6263627d8267385ea64d8bfc057","locale":"en-US","gatekeeper":"DF25AD3025E28FFB6B6C8701A1DA0DEEF8DA561973401A20FDC35FBFDB68118DEF63E653045C3B52BCDADCE57398C054AEA7B99DCD0FA2B1628E31E96AFE7BC0EC16F04DF6BA0CF2406C14EF3BFC6ECD73F4F8CC155AAD568EB6F44816A8C576667749FA70F9B9F48A99EC3723D2AEABEF11BBC65DB47E317B99BB95CC71D8D03B394999B87CC149618E59061DD0AD06A","historicalChat":"","confidenceScore":"","creditFlag":"N","engagedHandler":"mglueck","botId":"","channelId":"web","productCreatedDate":"","conversationId":"","conversationTopic":null,"languageId":"US","customerMemberId":"","ccpId":"mglueck","sessionId":"itc_9d9907d7-e64d-475f-b9ea-21b26e6b2797","globalCustomerMemberId":"","pegaMessageId":null,"createdDate":"2022-05-30T15:38:18.481Z","customerMemberIPAddress":"192.16.1","waitTime":"1358"}},"routeCode":"CCP","xmppId":"mglueck"}
... View more
Labels
- Labels:
-
field extraction
-
fields
-
metadata
-
regex
-
rex
05-27-2022
06:38 AM
Just curious. How would this work if in the same example we have ir7utbws001 as an entry as there is no 'period' your code would extract this as null. I wanted to extract the whole field if there is no period So basically what is alternative of | eval temp=split(URL,".") | eval Final=mvindex(temp,0)
... View more
05-04-2022
06:35 AM
ahh.. n00b mistake by me. @ITWhisperer you are correct. This worked, you are the best. Thanks a ton!
... View more
05-02-2022
11:29 AM
I dont get anyJSON string, I get what I was getting earlier. No changes. I get 1500 events in the below format.
... View more
05-01-2022
11:35 AM
Nothing @ITWhisperer I just get the events that I was getting earlier. No regex parsing. Could you please double check?
... View more
04-29-2022
01:52 PM
Sorry @ITWhisperer this did not work. Maybe I am doing something wrong. But this is not converting and returning the userdata package to a table format. userData | rex "OutboundWebHookPayload=(?<json>\{.*\})" | spath input=json userData output=userData | spath input=userData
... View more
04-29-2022
07:52 AM
is there away we can search for a , to find multi locale or multi country basically instead of the underlined
index=personmetrics logtype=personactivity wrk_grp="Ret,Ce" locale="en-US,en-GB"
1. how do we write?
index=ccpmetrics logtype=ccpactivity (wrk_grp LIKE "," OR locale LIKE ",") |table personname,wrk_grp,locale
2. bonus point: and then find the stats of personname and corresoponding entries.
... View more
Labels
- Labels:
-
lookup
-
search job inspector
-
stats
-
subsearch
04-29-2022
07:46 AM
How do I extract all fields from userdata?
accept=application/json, timestamp=1651243086870} OutboundWebHookPayload={"clientType":"Client","mediaType":"ask","subject":"EscapeClient","userData":{"country":"UK","lastName":"ELMER","agentId":"7060856","conversationId":"conv_1d55ec01e970c8833e8b8206be287fce","sessionId":"itc_58f7ad65-fcb0-46bd-81-1717f84dd7","chatSessionId":"s_eaf99b35-59fd-4d36-8f8f-c6423f8ec610","locale":"en-GB","languageCode":"en","experience":"Default","publicGuid":"1d55ec01e970c8833e8b8206be287fce","accountNumber":"XXXXXXXXXXXXXXX","firstName":"LUKE","environment":"prod","intentCode":"statement_balance","upfrontRoutingIntent":"CardServices","InteractionType":"Resume","customerId":"508558871407","channelName":"MApp","ProductType":" Card"}}
I tried
userData | rex field=_raw "userData.:{.IACode.:.(?<IACode>[A-Za-f0-9]+).,.country.*upfrontRoutingIntent.:.(?<upfrontRoutingIntent>[^\"]+).," | table IACode upfrontRoutingIntent
But I need other fields like Experience and Product type as well
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-21-2023
04:34 PM
|
