@ITWhisperer @Whatever you provided rex expression is not fetching the values  ... View more

@ITWhisperer @Will you able to provide the Rex for the below log format too. <><><><>||1407|| ... View more

I see couple of logs starting with this log format too <><><><>||1407|| could you please provide the Rex expression with already provided solution @ITWhisperer  ... View more

@isoutamo @Whatever you provided solution not extracting the timestamp and Kubernetes.pod ... View more

How to extract these fields timestamp,kubernetes.pod too along with the below provided solutions  @ITWhisperer  ... View more

@ITWhisperer  How to extract RequestID,http.endpoint,message,RequestType from these below mentioned different types logs {"@version":"1","tags":["_dateparsefailure"],"host":"wh-45sg.svr.us.xyz.net","s_sourcetype":"godn","log":"{\"timestamp\":\"2023-06-21T07:45:54.528Z\",\"logger\":\"com.csa.fsces.service.3Service\", \"instanceId\":\"unw-sthrage-service-green-58694cdbb8-smbjj\",\"namespace\":\"4248-ct-xrw-gkp-dev\", \"platform\":\"GKP\\",\"message\":\"Entity name: NDAN_POSITION_VUE,Record type: NR, Request Id: 100185, Infdund context: 485640257604\", \"level\":\"INFO\",\"traceId\":\"6492aa2326285332f853f16e2a49fd50\", \"spanId\":\"9dc079cc5ef24811\",\"remote-host\":\"123.456.125.09\", \"protocol\":\"HTTP/1.1\",\"http.endpoint\":\"POST /storage/e3/createfile/\", \"RequestID\":\"143185\",\"user-agent\":\"Java/17.0.7\",\"RequestType\":\"TR\"}", "Kubernetes.node":"hh-10feb4b660.svr.us.sj.net","appId":"5352","hostname":"gg-10geb4b660.svr.us.sj.net"} {"host":"xx-1345a0196e.svr.am.abcde.net","app_id":"4324","source":"fstatabd","@version":"1", "log":"{"timestamp":"2023-06-20T15:58:20.505Z","logger":"com.abcde.abcservices.service.ghstreamService", "instanceId":"abc-atments-service-green-55dbdb5859-75vkl","namespace":"80458d64606-ct-abc-gkp-test", "platform":"GKP","message":"Received xyz Callback Response for RequestId: 1436, Status code : 200 OK, Response Payload : Successfully received the response","level":"INFO","traceId":"6491cc9c8bb8f102fafe7b07de24a457", "spanId":"fafe7b07de24a457","remote-host":"123.027.16.57","protocol":"HTTP/1.1", "http.endpoint":"GET /ament/p2CallBack","requestType":"RRR","requestId":"1436"}", "s_sourcetype":"rost","tags":["_dateparsefailure"], "Kubernetes.node":"xx-1535a0196e.svr.am.abcde.net","appId":"4324","@timestamp":"2023-06-20T15:58:31.263Z"} {"log":"{\\"timestamp\\":\\"2023-06-21T07:45:54.528Z\\",\\"logger\\":\\"com.csa.fsces.service.3Service\\", \\"instanceId\\":\\"unw-sthrage-service-green-58694cdbb8-smbjj\\",\\"namespace\\":\\"4248-ct-xrw-gkp-dev\\", \\"platform\\":\\"GKP\\",\\"message\\":\\"Entity name: NDAN_POSITION_VUE, Record type: NR, Request Id: 100185, Infdund context: 485640257604\\", \\"level\\":\\"INFO\\",\\"traceId\\":\\"6492aa2326285332f853f16e2a49fd50\\", \\"spanId\\":\\"9dc079cc5ef24811\\",\\"remote-host\\":\\"123.456.125.09\\", \\"protocol\\":\\"HTTP/1.1\\",\\"http.endpoint\\":\\"POST /storage/e3/createfile/\\", \\"RequestID\\":\\"143185\\",\\"user-agent\\":\\"Java/17.0.7\\",\\"RequestType\\":\\"TR\\"}", "Kubernetes.node":"hh-10feb4b660.svr.us.sj.net","appId":"5352","hostname":"gg-10geb4b660.svr.us.sj.net"} ... View more

Please provide the steps for creation of dynamic dashboard with using the previous solution output.It should include timestamp ,requestId,instanceId,message ,endpoint. requestid,requesttype should be the dropdown menu and Date should be the calendar text field .based on these combination selections ,it should be populate the data in dashboard ... View more

Here is the sample _raw from the splunk but it has 2 different format log 1 format without double backslash(\\) and other one with double backslash(\\).How do I extract requestId,requestType,message,endpoint ? {"host":"xx-1345a0196e.svr.am.abcde.net","app_id":"4324","source":"fstatabd","@version":"1", "log":"{"timestamp":"2023-06-20T15:58:20.505Z","logger":"com.abcde.abcservices.service.ghstreamService", "instanceId":"abc-atments-service-green-55dbdb5859-75vkl","namespace":"80458d64606-ct-abc-gkp-test", "platform":"GKP","message":"Received xyz Callback Response for RequestId: 1436, Status code : 200 OK, Response Payload : Successfully received the response","level":"INFO","traceId":"6491cc9c8bb8f102fafe7b07de24a457", "spanId":"fafe7b07de24a457","remote-host":"123.027.16.57","protocol":"HTTP/1.1", "http.endpoint":"GET /ament/p2CallBack","requestType":"RRR","requestId":"1436"}", "s_sourcetype":"rost","tags":["_dateparsefailure"], "Kubernetes.node":"xx-1535a0196e.svr.am.abcde.net","appId":"4324","@timestamp":"2023-06-20T15:58:31.263Z"} {"log":"{\\"timestamp\\":\\"2023-06-21T07:45:54.528Z\\",\\"logger\\":\\"com.csa.fsces.service.3Service\\", \\"instanceId\\":\\"unw-sthrage-service-green-58694cdbb8-smbjj\\",\\"namespace\\":\\"4248-ct-xrw-gkp-dev\\", \\"platform\\":\\"GKP\\",\\"message\\":\\"Entity name: NDAN_POSITION_VUE, Record type: NR, Request Id: 100185, Infdund context: 485640257604\\", \\"level\\":\\"INFO\\",\\"traceId\\":\\"6492aa2326285332f853f16e2a49fd50\\", \\"spanId\\":\\"9dc079cc5ef24811\\",\\"remote-host\\":\\"123.456.125.09\\", \\"protocol\\":\\"HTTP/1.1\\",\\"http.endpoint\\":\\"POST /storage/e3/createfile/\\", \\"RequestID\\":\\"143185\\",\\"user-agent\\":\\"Java/17.0.7\\",\\"RequestType\\":\\"TR\\"}", "Kubernetes.node":"hh-10feb4b660.svr.us.sj.net","appId":"5352","hostname":"gg-10geb4b660.svr.us.sj.net"} ... View more

log is not available as a field. Solution didn't work  ... View more

@ITWhisperer  Could you please provide brief explanation about this regex  ... View more