从多行中获取值并组合

发布于 2025-01-12 19:46:01 字数 647 浏览 1 评论 0原文

我们将应用程序日志从不同主机和不同来源转发到 splunk。

Thread1 requestId=aUniqueID1 table=Table1

Thread1 size=2gb

Thread2 requestId=aUniqueID5 some other log

Thread1 requestId=aUniqueID1 some other log

Thread2 size=5gb

Thread1 requestId=aUniqueID2 table=Table2

Thread1 size=4gb

Thread1- requestId=aUniqueID3 table=Table3

这里我想要一个请求 ID 和大小的表

aUniqueId1  2gb

aUniqueId2  4gb

aUniqueID5 5gb

基本上，每个主机的线程名称保持相同，但一旦请求完成，同一线程将被重用。

有人可以帮忙写一个 Splunk 查询吗？

当请求到来时，可以通过线程名称（Thread1、Thread2等）来标识日志。

基本上对于事务来说，大多数日志语句都有 requestId 并且我知道开始和结束时间，因此我知道该时间范围内的大小（按主机和源类型以及线程名称）

原文

We forwarded app logs to splunk from different host and different sources.

Thread1 requestId=aUniqueID1 table=Table1

Thread1 size=2gb

Thread2 requestId=aUniqueID5 some other log

Thread1 requestId=aUniqueID1 some other log

Thread2 size=5gb

Thread1 requestId=aUniqueID2 table=Table2

Thread1 size=4gb

Thread1- requestId=aUniqueID3 table=Table3

Here I want to a table of request Id and size

aUniqueId1  2gb

aUniqueId2  4gb

aUniqueID5 5gb

Basically, thread name stays the same per host, but the same thread will be reused once a request is completed.

Can someone help write a Splunk query?

When a request comes, a log can be identified with thread name (Thread1,Thread2,etc)

Basically for a transaction, most log statements have requestId and I know the start and end times, thus I know the size within that time range (by host and sourcetype and thread name)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

感情旳空白 2025-01-19 19:46:03

下面是一个随处运行的示例，说明了如何执行此操作。

| makeresults | eval data="Thread1 requestId=aUniqueID1 table=Table1
Thread1 size=2gb
Thread1 requestId=aUniqueID1 some otherlog
Thread1 requestId=aUniqueID2 table=Table2
Thread1 size=4gb
Thread1 requestId=aUniqueID3 table=Table3" | eval data=split(data,"
") | mvexpand data | eval _raw=data
```Everything above sets up test data.  Omit when using live data```
```Combine requestId and size lines```
| transaction startswith="requestId" endswith="size"
```Parse the results```
| extract kvdelim=" ", pairdelim="="
```Display request ID and corresponding size```
| table requestId size

Here is a run-anywhere example of how to do that.

| makeresults | eval data="Thread1 requestId=aUniqueID1 table=Table1
Thread1 size=2gb
Thread1 requestId=aUniqueID1 some otherlog
Thread1 requestId=aUniqueID2 table=Table2
Thread1 size=4gb
Thread1 requestId=aUniqueID3 table=Table3" | eval data=split(data,"
") | mvexpand data | eval _raw=data
```Everything above sets up test data.  Omit when using live data```
```Combine requestId and size lines```
| transaction startswith="requestId" endswith="size"
```Parse the results```
| extract kvdelim=" ", pairdelim="="
```Display request ID and corresponding size```
| table requestId size

回复收藏 0 原文

~没有更多了~